Executive brief
marsdb is a JavaScript database library used for data storage and querying. A command injection vulnerability exists in its query matching logic, allowing attackers to execute arbitrary system commands by providing specially crafted query parameters. Since no patch is available, users should switch to an alternative database library until this is resolved.
Technical details
The vulnerability is a command injection (CWE-77) in marsdb's DocumentMatcher class. The root cause is that selectors in $where clauses are passed unsanitized directly to JavaScript's Function constructor, allowing arbitrary code execution. An attacker who can supply query input (network reachable if the library is used in a web service, or local if used in an application) can craft a malicious $where selector that executes arbitrary system commands when the query is processed. This affects all versions of marsdb from 0.0.0 onward. No fix has been released as of the advisory publication date (2020-09-03).
Affected products
- npm marsdb 0.0.0 and later
Timeline
- 2020-09-03: disclosed: Advisory published; CWE-77 (Command Injection) noted
- 2020-08-31: advisory: GitHub reviewed advisory