Executive brief
loopback-connector-mongodb is a connector library that allows LoopBack applications to interact with MongoDB databases. Versions before 3.6.0 fail to sanitize user-supplied query filters, allowing attackers to inject malicious JavaScript code (via the $where property) that executes on the MongoDB server, potentially leading to arbitrary data access, modification, or denial of service.
Technical details
This is a NoSQL injection vulnerability (CWE-89) in the query filter handling of loopback-connector-mongodb. The connector fails to sanitize the $where property in MongoDB query filters, allowing it to pass through to the MongoDB driver, which interprets $where as a directive to execute arbitrary JavaScript code on the server. The vulnerability is network-reachable and requires no authentication—an attacker can craft a malicious REST API query with a filter containing $where and JavaScript code to execute queries that sleep, iterate over data, or perform other operations. The fix (version 3.6.0+) adds a sanitizeFilter function that removes the $where and mapReduce properties from query objects by default, with an option to disable sanitization if explicitly required.
Affected products
- StrongLoop loopback-connector-mongodb before 3.6.0
Timeline
- 2019-06-04: disclosed
- 2018-08-15: patched: Fix merged in PR #452