Executive brief
express-cart is a Node.js e-commerce shopping cart application. Attackers can bypass authentication and extract sensitive data (such as authentication tokens) by injecting NoSQL operators into the login forms, similar to SQL injection attacks on traditional databases. This allows unauthorized access to both customer and admin accounts.
Technical details
The vulnerability is a NoSQL injection flaw (CWE-89) in the customer and admin login handlers of express-cart. User input from JSON request bodies is passed directly into MongoDB queries without sanitization, allowing attackers to insert MongoDB operators such as $regex. An attacker can exploit this via a network request to the login endpoint (no authentication required) to perform blind injection attacks, character-by-character extraction of authentication tokens or credentials. The vulnerability affects all versions before 1.1.8, which introduced input validation. A fix is available by updating to version 1.1.8 or later.
Affected products
- express-cart express-cart before 1.1.8
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: Version 1.1.8 or later