Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 3 September 2020.
- Which products and versions are affected?
- MongoDB Node.js Driver before 3.1.13.
- Is there a fix for This vulnerability?
- A patch was published on 2020-09-03: Fix available in version 3.1.13 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected?
- Check whether you run MongoDB Node.js Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an unhandled exception flaw in the MongoDB Node.js driver (npm package). When a collection name is invalid and the database does not exist, the driver fails to catch an exception, leading to an application crash. The attack vector is local or network-based depending on how the driver is exposed; an attacker or malicious client can send requests with invalid collection names to trigger the denial of service. No authentication bypass or data access is possible; the impact is limited to application availability. The flaw affects all versions prior to 3.1.13, which introduced proper exception handling. A patch is available by upgrading to version 3.1.13 or later.
Affected products
- MongoDB Node.js Driver before 3.1.13
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fix available in version 3.1.13 and later