CVE-2023-52555: mongo-express Cross-Site Request Forgery in admin interface

CVE-2023-52555 · Severity: low · CVSS 3.1 · Published 2024-03-01

mongo-express is a web-based MongoDB administration tool used to manage databases. An attacker can trick an authenticated admin into performing sensitive actions—such as deleting database collections—by making them click a malicious link or visit a compromised webpage. This can result in unintended data loss or database corruption.

Technologies: mongo-express (npm). Vendors: npm.

Quick answers

Is CVE-2023-52555 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-52555 being exploited in the wild.
How severe is CVE-2023-52555?
Low severity, with a CVSS score of 3.1, published 1 March 2024.
Which products and versions are affected?
mongo-express (npm) SEMVER:introduced=0,last_affected=1.0.2.
Is there a fix for CVE-2023-52555?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-52555 attacked?
It is attacked over the network.
Am I affected by CVE-2023-52555?
Check whether you run mongo-express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF, CWE-352) in the /admin endpoint of mongo-express. The admin interface performs sensitive operations (e.g., collection deletion) without validating CSRF tokens or verifying that requests originated from the legitimate application. An attacker can craft a malicious HTML page that submits a forged POST request to delete database tables when a logged-in admin visits it, requiring only that the admin be authenticated and click the link (user interaction required). No patch availability information is mentioned in the advisory details.

Affected products

  • mongo-express mongo-express 1.0.2 and earlier

Identifiers

  • CVE-2023-52555
  • GHSA-fffg-cwc9-xvj7

Timeline

  • 2023-11-13: disclosed: Vulnerability reported on GitHub issue #1338
  • 2024-03-01: advisory: Published as CVE-2023-52555 and GHSA-fffg-cwc9-xvj7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.