Critical Deserialization Vulnerability in node-mongodb Package
Summary
CVE-2020-7610: All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Affects node-mongodb across 2 version ranges.
< 3.5.6+~cs11.12.19-1
>= 4ca8e388f4b5a1aaa06a464dedc6a95fb2ab486c, < 6e782dac6a110509097077ee5edd311977f32522
Fixed in 3.5.6+~cs11.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-mongodb package is a widely used library that facilitates interaction with MongoDB databases in Node.js applications. It provides a simple and efficient way to perform database operations, making it a popular choice among developers. However, all versions of bson prior to 1.1.4 are vulnerable to a serious deserialization issue that can lead to unintended data manipulation and security breaches.
Vulnerability Detail
The vulnerability arises from the way the bson package handles unknown values for an object's _bsotype. When an unknown value is encountered, the package ignores it and may serialize the object as a document instead of the intended BSON type. This behavior can be exploited by attackers to manipulate data, potentially leading to unauthorized access and data integrity issues. The vulnerability has a CVSS score of 9.8, indicating its critical nature and the severe impact it can have on affected systems.
How To Fix
Minimum fixed version
3.5.6+~cs11.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mongodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to ensure that only trusted data is deserialized. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The deserialization vulnerability in the node-mongodb package poses a significant risk to applications using this library. It is crucial to upgrade to the latest version to safeguard against potential exploits. Regular monitoring and validation practices can further enhance security.
See every vulnerability recorded for node-mongodb →
FAQ
The vulnerability can lead to unauthorized data manipulation and potential security breaches, allowing attackers to exploit the deserialization process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an upgrade is not possible, implement input validation to mitigate risks until you can apply the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mongodb.
