Executive brief
mongo-express is a web-based MongoDB administration tool. Two cross-site scripting (XSS) vulnerabilities allow unauthorized users to inject malicious code that executes in admin browsers, potentially enabling theft of sensitive database exports, unauthorized database operations, or session hijacking without the administrator's knowledge.
Technical details
Two distinct XSS vulnerabilities exist in mongo-express. The first occurs when document content exceeds display limits: clicking a truncated row displays the full unescaped document to an admin user, allowing injected JavaScript execution. The second vulnerability is in media cell rendering (image, audio, video), where data cells identified as media are rendered without sanitization, permitting script injection. Both attack vectors require admin user interaction. Successful exploitation enables attackers to execute arbitrary JavaScript in the admin's browser context, potentially exfiltrating database exports, dropping databases, or performing unauthorized administrative actions. The vulnerabilities affect all versions prior to v1.0.0-alpha.4, which includes the patch.
Affected products
- mongo-express mongo-express < v1.0.0-alpha.4
Timeline
- 2021-06-28: disclosed
- 2021-06-28: patched: v1.0.0-alpha.4