Is CVE-2024-6376 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6376 being exploited in the wild.

How severe is CVE-2024-6376?

Low severity, with a CVSS score of 3.1, published 1 July 2024.

Which products and versions are affected?

MongoDB Compass before 1.42.2; @mongodb-js/connection-form (npm) SEMVER:introduced=0,fixed=1.20.1.

Is there a fix for CVE-2024-6376?

Yes. @mongodb-js/connection-form (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6376 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2024-6376?

Check whether you run MongoDB Compass or @mongodb-js/connection-form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6376: MongoDB Compass code injection in EJSON shell parser

CVE-2024-6376 · Severity: low · CVSS 3.1 · Published 2024-07-01

MongoDB Compass is a graphical user interface for connecting to and managing MongoDB databases. A code injection vulnerability in the EJSON shell parser could allow an attacker to execute arbitrary code when a user handles specially crafted connection strings or configuration data, potentially compromising the developer's machine and the databases they access.

Technologies: MongoDB Compass. Vendors: MongoDB, npm.

Quick answers

Is CVE-2024-6376 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6376 being exploited in the wild.
How severe is CVE-2024-6376?: Low severity, with a CVSS score of 3.1, published 1 July 2024.
Which products and versions are affected?: MongoDB Compass before 1.42.2; @mongodb-js/connection-form (npm) SEMVER:introduced=0,fixed=1.20.1.
Is there a fix for CVE-2024-6376?: Yes. @mongodb-js/connection-form (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6376 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2024-6376?: Check whether you run MongoDB Compass or @mongodb-js/connection-form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@mongodb-js/connection-form (npm): upgrade to 1.20.1 or later
```
npm install @mongodb-js/connection-form@1.20.1
```

Technical details

The vulnerability exists due to insufficient sandbox protection in MongoDB Compass's EJSON shell parser used during connection handling. The parser lacked proper input validation (CWE-20) and was susceptible to improper control of generation of code (CWE-94), allowing code injection. Attack requires user interaction (local attack vector with high complexity, no privilege required) when processing untrusted connection strings or EJSON data. An attacker can achieve arbitrary code execution on the user's machine. The fix involves enabling strict mode on the EJSON shell parser (commit b1f8050) and was released in version 1.42.2 of MongoDB Compass.

Affected products

MongoDB Compass before 1.42.2

Identifiers

CVE-2024-6376
GHSA-jxr4-4prv-mh83

Timeline

2024-07-01: disclosed: Published on GitHub Advisory Database
2024-07-01: patched: Fix released in MongoDB Compass 1.42.2

References

https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.