Executive brief
MongoDB Compass is a graphical user interface for connecting to and managing MongoDB databases. A code injection vulnerability in the EJSON shell parser could allow an attacker to execute arbitrary code when a user handles specially crafted connection strings or configuration data, potentially compromising the developer's machine and the databases they access.
Technical details
The vulnerability exists due to insufficient sandbox protection in MongoDB Compass's EJSON shell parser used during connection handling. The parser lacked proper input validation (CWE-20) and was susceptible to improper control of generation of code (CWE-94), allowing code injection. Attack requires user interaction (local attack vector with high complexity, no privilege required) when processing untrusted connection strings or EJSON data. An attacker can achieve arbitrary code execution on the user's machine. The fix involves enabling strict mode on the EJSON shell parser (commit b1f8050) and was released in version 1.42.2 of MongoDB Compass.
Affected products
- MongoDB Compass before 1.42.2
Timeline
- 2024-07-01: disclosed: Published on GitHub Advisory Database
- 2024-07-01: patched: Fix released in MongoDB Compass 1.42.2