Executive brief
mongo-express is a web-based MongoDB administration tool used to manage databases and collections. An unsafe implementation of advanced query syntax allows attackers to execute arbitrary code on the server, potentially compromising the entire database and any systems the application can reach.
Technical details
The vulnerability exists in mongo-express before version 1.0.0 and its dependency mongodb-query-parser, where advanced MongoDB query syntax is parsed without proper sanitization (CWE-20: Improper Input Validation). The root cause is unsafe handling of query expressions that allows code injection. An unauthenticated attacker can craft a malicious MongoDB query and send it to the mongo-express web interface over the network to achieve remote code execution. The vulnerability has been patched in mongodb-query-parser version 2.0.0 and mongo-express 1.0.0.
Affected products
- mongo-express mongo-express before 1.0.0
- mongodb-js query-parser before 2.0.0
Timeline
- 2021-03-30: disclosed: NVD published vulnerability
- 2021-04-13: advisory: GitHub Security Advisory published