Is CVE-2020-24391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-24391 being exploited in the wild.

How severe is CVE-2020-24391?

Low severity, with a CVSS score of 3.1, published 13 April 2021.

Which products and versions are affected?

Mongodb-Js Query-Parser before 2.0.0; mongodb-query-parser (npm) SEMVER:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2020-24391?

Yes. mongodb-query-parser (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-24391 attacked?

It is attacked over the network.

Am I affected by CVE-2020-24391?

Check whether you run Mongodb-Js Query-Parser or mongodb-query-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-24391: mongo-express remote code execution in query parsing

CVE-2020-24391 · Severity: low · CVSS 3.1 · Published 2021-04-13

mongo-express is a web-based MongoDB administration tool used to manage databases and collections. An unsafe implementation of advanced query syntax allows attackers to execute arbitrary code on the server, potentially compromising the entire database and any systems the application can reach.

Vendors: npm.

Quick answers

Is CVE-2020-24391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-24391 being exploited in the wild.
How severe is CVE-2020-24391?: Low severity, with a CVSS score of 3.1, published 13 April 2021.
Which products and versions are affected?: Mongodb-Js Query-Parser before 2.0.0; mongodb-query-parser (npm) SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2020-24391?: Yes. mongodb-query-parser (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-24391 attacked?: It is attacked over the network.
Am I affected by CVE-2020-24391?: Check whether you run Mongodb-Js Query-Parser or mongodb-query-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mongodb-query-parser (npm): upgrade to 2.0.0 or later
```
npm install mongodb-query-parser@2.0.0
```

Technical details

The vulnerability exists in mongo-express before version 1.0.0 and its dependency mongodb-query-parser, where advanced MongoDB query syntax is parsed without proper sanitization (CWE-20: Improper Input Validation). The root cause is unsafe handling of query expressions that allows code injection. An unauthenticated attacker can craft a malicious MongoDB query and send it to the mongo-express web interface over the network to achieve remote code execution. The vulnerability has been patched in mongodb-query-parser version 2.0.0 and mongo-express 1.0.0.

Affected products

mongo-express mongo-express before 1.0.0
mongodb-js query-parser before 2.0.0

Identifiers

CVE-2020-24391
GHSA-hxmg-hm46-cf62

Timeline

2021-03-30: disclosed: NVD published vulnerability
2021-04-13: advisory: GitHub Security Advisory published

References

https://github.com/mongodb-js/query-parser/issues/16

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.