Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 1 September 2020.

Which products and versions are affected?

express-cart (npm) SEMVER:introduced=0,fixed=1.1.8.

Is there a fix for This vulnerability?

Yes. express-cart (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

express-cart NoSQL injection in login

Severity: info · Published 2020-09-01

express-cart is a Node.js e-commerce shopping cart application. Attackers can bypass authentication and extract sensitive data (such as authentication tokens) by injecting NoSQL operators into the login forms, similar to SQL injection attacks on traditional databases. This allows unauthorized access to both customer and admin accounts.

Technologies: express-cart (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 1 September 2020.
Which products and versions are affected?: express-cart (npm) SEMVER:introduced=0,fixed=1.1.8.
Is there a fix for This vulnerability?: Yes. express-cart (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

express-cart (npm): upgrade to 1.1.8 or later
```
npm install express-cart@1.1.8
```

Technical details

The vulnerability is a NoSQL injection flaw (CWE-89) in the customer and admin login handlers of express-cart. User input from JSON request bodies is passed directly into MongoDB queries without sanitization, allowing attackers to insert MongoDB operators such as $regex. An attacker can exploit this via a network request to the login endpoint (no authentication required) to perform blind injection attacks, character-by-character extraction of authentication tokens or credentials. The vulnerability affects all versions before 1.1.8, which introduced input validation. A fix is available by updating to version 1.1.8 or later.

Affected products

express-cart express-cart before 1.1.8

Timeline

2020-09-01: disclosed
2020-09-01: patched: Version 1.1.8 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.