Executive brief
loopback-connector-mongodb is a database connector plugin for the LoopBack framework that integrates MongoDB with applications. The connector fails to properly sanitize database query filters, allowing attackers to inject NoSQL code that executes against the MongoDB database. This can lead to unauthorized data access, modification, or deletion depending on the attacker's intentions and database permissions.
Technical details
The vulnerability is a NoSQL injection flaw (CWE-89) in loopback-connector-mongodb versions prior to 3.6.0. Query filters passed to database operations are not properly sanitized before execution, allowing an attacker to inject arbitrary NoSQL code into the database driver. The attack requires the attacker to control query filter parameters sent to the connector, typically through application input. An attacker can execute unintended database queries, exfiltrate data, or modify database contents. The fix is available in version 3.6.0 and later.
Affected products
- LoopBack loopback-connector-mongodb < 3.6.0
Timeline
- 2020-09-02: disclosed