Regular Expression Denial of Service (ReDoS) in js-bson - MongoDB Package Vulnerability
Summary
CVE-2018-13863: The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. Affects node-mongodb across 2 version ranges.
< 3.1.10+~3.1.9-1
< bd61c45157c53a1698ff23770160cf4783e9ea4a
Fixed in 3.1.10+~3.1.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-bson module is a JavaScript library used for encoding and decoding BSON (Binary JSON) data, which is essential for MongoDB operations. It allows developers to work with MongoDB data structures in a more manageable way. The vulnerability in question affects versions 0.5.0 to 1.0.x before 1.0.5, making it susceptible to a Regular Expression Denial of Service (ReDoS) attack when parsing untrusted strings.
Vulnerability Detail
The vulnerability arises from the Decimal128.fromString() function in the js-bson library, which can be exploited by passing a long, untrusted string. This can lead to excessive backtracking in regular expressions, causing the application to hang or crash. The potential ramifications include service downtime and denial of access to legitimate users, which can severely impact application performance and reliability.
How To Fix
Minimum fixed version
3.1.10+~3.1.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mongodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Decimal128.fromString() function with untrusted input. Implement input validation to ensure that only safe, expected strings are processed by this function.
Conclusion
The js-bson vulnerability (CVE-2018-13863) poses a significant risk due to its potential to cause Denial of Service attacks. It is crucial for developers using affected versions to update their packages promptly and implement necessary workarounds to safeguard their applications.
See every vulnerability recorded for node-mongodb →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions 0.5.0 to 1.0.x before 1.0.5 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to service downtime and denial of access to legitimate users, severely impacting application performance.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mongodb.
