CVE-2019-10758criticalunder attackCWE-94

CVE-2019-10758: critical vulnerability in mongo-express

Published · Updated

Follow this CVE+ Monitor mongo-express+ Monitor mongo-express

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.9epss 85%
from disclosure to weapon2 days
Published on NVDDec 24
1st PoC+2d
CISA KEV+717d
Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

In short

mongo-express versions before 0.54.0 allow attackers to execute arbitrary code on the server through unsafe use of the vm module. An attacker can send specially crafted requests to vulnerable endpoints that use the toBSON method to run commands with server privileges.

Technical detail

Remote Code Execution vulnerability in mongo-express <0.54.0 exploits unsafe vm.Script execution in toBSON endpoints. The vm module is used improperly to evaluate untrusted input, allowing an unauthenticated attacker to execute arbitrary system commands with the privileges of the mongo-express process.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · mongo-express
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.