CVE-2019-10758: MongoDB mongo-express Remote Code Execution Vulnerability
Impact
Remote code execution on the host machine by any authenticated user.
Proof Of Concept
Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:
javascript this.constructor.constructor("return process")().mainModule.require('childprocess').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')
Patches Users should upgrade to version 0.54.0
Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?
For more information If you have any questions or comments about this advisory: Open an issue in example link to repo Email us at example email address
Thanks
@JLLeitschuh for finding and reporting this vulnerability
This vulnerability has been exploited in the wild.
Other sources
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/mongo-expressto a version that resolves this vulnerability.Fixed in 0.54.0 - Upgrade
Upgrade
mongo-expressto a version that resolves this vulnerability.Fixed in 0.54.0
Event History
Frequently Asked Questions
What is CVE-2019-10758?
CVE-2019-10758 is a vulnerability in MongoDB mongo-express that allows for remote code execution on the host machine by any authenticated user.
How severe is CVE-2019-10758?
CVE-2019-10758 has a severity rating of 9.9 (Critical).
How can I fix CVE-2019-10758 vulnerability?
To fix the CVE-2019-10758 vulnerability, update mongo-express to version 0.54.0 or later.
What software is affected by CVE-2019-10758?
The vulnerability affects MongoDB mongo-express version up to and excluding 0.54.0.
Where can I find more information about CVE-2019-10758?
You can find more information about CVE-2019-10758 at the following references: [Reference 1](https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq), [Reference 2](https://github.com/mongo-express/mongo-express/pull/522), [Reference 3](https://github.com/mongo-express/mongo-express/commit/7d365141deadbd38fa961cd835ce68eab5731494).