Command Injection in marsdb
Summary
GHSA-5mrr-rgp6-x4gr: Command Injection in marsdb. Affects marsdb versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marsdb package is an open-source npm package used for database operations. It provides functionality for querying and manipulating data in a MongoDB-like manner. However, all versions of marsdb are vulnerable to Command Injection.
Vulnerability Detail
The vulnerability exists in the DocumentMatcher class of marsdb, where selectors on $where clauses are passed to a Function constructor without proper sanitization. This allows attackers to inject and execute arbitrary commands in the system when the function is executed. The impact of this vulnerability can be severe, as it enables unauthorized execution of commands on the system where the package is being used.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no official fix, a possible workaround is to implement strict input validation and sanitization when using the affected functionality of marsdb. This can help mitigate the risk of command injection attacks. Here's an example of how input validation can be done in JavaScript:
const userInput = req.body.selector;
const sanitizedInput = userInput.replace(/[&|;$%@"<>()+,]/g, '');
// Use the sanitized input in the `$where` clause
Conclusion
The marsdb package is vulnerable to Command Injection, allowing attackers to execute arbitrary commands on the system. Currently, no fix is available, and it is recommended to use an alternative package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for marsdb →
FAQ
marsdb is an npm package used for database operations, providing MongoDB-like functionality.
Command Injection is a security vulnerability where an attacker can execute arbitrary commands on a system by injecting malicious input into a command execution function.
The vulnerability allows attackers to execute arbitrary commands on the system where marsdb is being used. This can lead to unauthorized access, data manipulation, or even complete system compromise.
Currently, there is no fix available for this vulnerability in marsdb. It is recommended to use an alternative package until a fix is released.
To mitigate the risk, implement strict input validation and sanitization when using the affected functionality of marsdb. Additionally, consider using an alternative package until a fix is available.
