Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 4 September 2020.
- Which products and versions are affected?
- mongodb-query-parser (npm) SEMVER:introduced=0,fixed=2.0.0.
- Is there a fix for This vulnerability?
- Yes. mongodb-query-parser (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run mongodb-query-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mongodb-query-parser (npm): upgrade to 2.0.0 or later
npm install mongodb-query-parser@2.0.0
Technical details
mongodb-query-parser versions before 2.0.0 contain an improper input validation vulnerability in the query parsing functionality. The vulnerability allows attackers to inject malicious JavaScript code through query strings, which are then evaluated without sanitization. An attacker can craft a payload using constructor functions to access the Node.js `require()` mechanism and execute arbitrary system commands. The attack requires the attacker to supply a crafted query to an application that uses the vulnerable library, but no additional authentication or special preconditions are needed. The fix is available in version 2.0.0 and later.
Affected products
- mongodb-query-parser mongodb-query-parser before 2.0.0
Timeline
- 2020-09-04: disclosed