Junglewise Threat Intelligence

mongodb-query-parser code execution via unsanitized queries

Severity: info · Published 2020-09-04

Vendors: npm.

Executive brief

mongodb-query-parser is a JavaScript library used to parse MongoDB query syntax. Versions prior to 2.0.0 fail to sanitize user-supplied queries, allowing attackers to inject and execute arbitrary code on systems using the library. This can lead to complete system compromise, unauthorized data access, or service disruption.

Technical details

mongodb-query-parser versions before 2.0.0 contain an improper input validation vulnerability in the query parsing functionality. The vulnerability allows attackers to inject malicious JavaScript code through query strings, which are then evaluated without sanitization. An attacker can craft a payload using constructor functions to access the Node.js `require()` mechanism and execute arbitrary system commands. The attack requires the attacker to supply a crafted query to an application that uses the vulnerable library, but no additional authentication or special preconditions are needed. The fix is available in version 2.0.0 and later.

Affected products

  • mongodb-query-parser mongodb-query-parser before 2.0.0

Timeline

  • 2020-09-04: disclosed

References

Related threats