CVE-2020-7610: MongoDB bson deserialization of untrusted data

CVE-2020-7610 · Severity: low · CVSS 3.1 · Published 2021-05-07

The bson JavaScript library, used to parse and serialize binary data in MongoDB applications, fails to validate the _bsontype field during deserialization. An attacker can supply a malicious bson object with an invalid _bsontype value, causing it to be serialized as a generic document instead of the intended type, potentially leading to type confusion attacks that bypass application logic or expose sensitive data.

Technologies: bson (npm). Vendors: npm.

Quick answers

Is CVE-2020-7610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-7610 being exploited in the wild.
How severe is CVE-2020-7610?
Low severity, with a CVSS score of 3.1, published 7 May 2021.
Which products and versions are affected?
bson (npm) SEMVER:introduced=0,fixed=1.1.4.
Is there a fix for CVE-2020-7610?
Yes. bson (npm): upgrade to 1.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7610 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-7610?
Check whether you run bson (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bson (npm): upgrade to 1.1.4 or later
    npm install bson@1.1.4

Technical details

This is a deserialization vulnerability (CWE-502) in the bson npm package affecting all versions before 1.1.4. The vulnerability arises because the serializer ignores unknown or invalid values for the _bsontype property during object serialization, allowing an attacker to construct a malicious object that will be serialized as an unintended BSON type. The attack requires no authentication or user interaction and is remotely exploitable over the network. An attacker can craft a payload with an invalid _bsontype to cause type confusion, potentially bypassing security checks or enabling object injection attacks. The vulnerability was patched in version 1.1.4 to throw an error when an invalid _bsontype is detected during serialization.

Affected products

  • MongoDB bson before 1.1.4

Identifiers

  • CVE-2020-7610
  • GHSA-v8w9-2789-6hhr

Timeline

  • 2021-05-07: disclosed: GHSA-v8w9-2789-6hhr published
  • 2020-03-30: patched: CVE-2020-7610 reported; fix committed to js-bson

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.