Executive brief
mongo-express is a web-based MongoDB administration tool used to manage databases. An attacker can trick an authenticated admin into performing sensitive actions—such as deleting database collections—by making them click a malicious link or visit a compromised webpage. This can result in unintended data loss or database corruption.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF, CWE-352) in the /admin endpoint of mongo-express. The admin interface performs sensitive operations (e.g., collection deletion) without validating CSRF tokens or verifying that requests originated from the legitimate application. An attacker can craft a malicious HTML page that submits a forged POST request to delete database tables when a logged-in admin visits it, requiring only that the admin be authenticated and click the link (user interaction required). No patch availability information is mentioned in the advisory details.
Affected products
- mongo-express mongo-express 1.0.2 and earlier
Timeline
- 2023-11-13: disclosed: Vulnerability reported on GitHub issue #1338
- 2024-03-01: advisory: Published as CVE-2023-52555 and GHSA-fffg-cwc9-xvj7