Executive brief
mongodb-query-parser is a JavaScript library used to parse MongoDB query syntax. Versions prior to 2.0.0 fail to sanitize user-supplied queries, allowing attackers to inject and execute arbitrary code on systems using the library. This can lead to complete system compromise, unauthorized data access, or service disruption.
Technical details
mongodb-query-parser versions before 2.0.0 contain an improper input validation vulnerability in the query parsing functionality. The vulnerability allows attackers to inject malicious JavaScript code through query strings, which are then evaluated without sanitization. An attacker can craft a payload using constructor functions to access the Node.js `require()` mechanism and execute arbitrary system commands. The attack requires the attacker to supply a crafted query to an application that uses the vulnerable library, but no additional authentication or special preconditions are needed. The fix is available in version 2.0.0 and later.
Affected products
- mongodb-query-parser mongodb-query-parser before 2.0.0
Timeline
- 2020-09-04: disclosed