Executive brief
mongo-express is a web-based administration interface for MongoDB databases. An attacker with administrative access can trigger a denial of service by exporting an empty collection as CSV, causing the application to crash due to an unhandled exception. This results in temporary unavailability of the database management interface.
Technical details
The vulnerability is an unhandled exception (CWE-754) in mongo-express's CSV export functionality when processing empty collections. The attack requires high-privilege administrative access to the mongo-express interface and network reachability to the web application. When an attacker attempts to export an empty collection as CSV, a crash occurs due to improper error handling. The affected versions are 0.54.0 and all previous versions. Patches addressing this issue are available in later releases.
Affected products
- mongo-express mongo-express 0.54.0 and earlier
Timeline
- 2021-04-13: disclosed: CVE published
- 2021-10-06: advisory: GHSA advisory published