Remote Code Execution in mongodb-query-parser
Summary
GHSA-97mg-3cr6-3x4c: Remote Code Execution in mongodb-query-parser. Affects mongodb-query-parser versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mongodb-query-parser package is an npm package used for parsing MongoDB queries. It is responsible for sanitizing and processing queries to ensure the security and integrity of the system. However, versions prior to 2.0.0 are vulnerable to Remote Code Execution. This vulnerability allows attackers to execute arbitrary code in the system by exploiting the package's failure to properly sanitize queries.
Vulnerability Detail
The vulnerability in mongodb-query-parser arises from the lack of query sanitization. Attackers can inject malicious code into queries, which will then be executed by the system. This can lead to various security risks, including unauthorized access, data breaches, and system compromise. An example payload that can be used to exploit this vulnerability is:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
When this payload is parsed by the vulnerable package, it will execute the command touch test-file, demonstrating the potential for arbitrary code execution.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
npm install mongodb-query-parser@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
The mongodb-query-parser package prior to version 2.0.0 is vulnerable to Remote Code Execution. It is crucial to upgrade to the fixed version to mitigate the risk of arbitrary code execution and ensure the security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mongodb-query-parser →
FAQ
This vulnerability allows attackers to execute arbitrary code in the system, which can lead to unauthorized access, data breaches, and system compromise.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
While specific exploits may not be publicly available, the vulnerability itself allows for remote code execution. Attackers can craft malicious payloads to exploit this vulnerability and execute arbitrary code in the system.
Yes, a patch is available in version 2.0.0 of the mongodb-query-parser package. Upgrading to this version will fix the vulnerability and prevent remote code execution.
There is no specific evidence of this vulnerability being exploited in the wild. However, it is important to promptly address and fix vulnerabilities to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongodb-query-parser.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
