Critical Deserialization Vulnerability in Node-MongoDB Package
Summary
DEBIAN-CVE-2020-7610: All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Affects node-mongodb versions < 3.5.6+~cs11.12.19-1. Fixed in 3.5.6+~cs11.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-MongoDB is a widely used package that facilitates interaction between Node.js applications and MongoDB databases. It provides a robust API for performing CRUD operations and managing database connections. However, it has been identified that all versions of bson prior to 1.1.4 are susceptible to a critical vulnerability that allows for the deserialization of untrusted data, potentially leading to severe security issues.
Vulnerability Detail
The vulnerability arises from the package's handling of BSON types. Specifically, it ignores unknown values for an object's _bsotype, which can result in an object being serialized as a document instead of the intended BSON type. This flaw can be exploited by attackers to manipulate data structures, leading to unauthorized access or data corruption.
How To Fix
Minimum fixed version
3.5.6+~cs11.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-mongodbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that only trusted data is processed. This can help mitigate the risk of deserialization attacks until the package is updated.
Conclusion
The node-mongodb package has a critical vulnerability related to deserialization of untrusted data, affecting all versions prior to 1.1.4. It is crucial to update to the patched version to safeguard your applications from potential exploits. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for node-mongodb →
FAQ
The vulnerability is a deserialization issue that allows untrusted data to be processed, potentially leading to data manipulation or unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to data corruption, unauthorized access to sensitive information, and potential system compromise.
Yes, a patched version of the node-mongodb package is available. You should update to version 3.5.6+~cs11.12.19-1 or later.
If an immediate update is not possible, implement input validation to restrict the processing of untrusted data as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-mongodb.
