CVE-2024-6376: ejson shell parser in MongoDB Compass maybe bypassed
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@mongodb-js/connection-formto a version that resolves this vulnerability.Fixed in 1.20.1 - Upgrade
Upgrade
MongoDB Compassto a version that resolves this vulnerability.Fixed in 1.42.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6376?
CVE-2024-6376 is classified as a code injection vulnerability with a critical severity level due to the risk of executing malicious code.
How do I fix CVE-2024-6376?
To fix CVE-2024-6376, upgrade MongoDB Compass to version 1.42.2 or later.
What versions of MongoDB Compass are affected by CVE-2024-6376?
CVE-2024-6376 affects all versions of MongoDB Compass prior to version 1.42.2.
What causes CVE-2024-6376?
CVE-2024-6376 is caused by insufficient sandbox protection settings in MongoDB Compass combined with the use of the ejson shell parser.
Is CVE-2024-6376 a local or remote vulnerability?
CVE-2024-6376 is a local vulnerability, as it requires access to the MongoDB Compass application to exploit.