CVE-2020-24391

CRITICALNuclei

Remote code execution in mongo-express

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2020-24391 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

mongodb-query-parser

Browse npm / mongodb-query-parser
GitHub AdvisoryBefore 2.0.0 · Fixed in 2.0.0affected

Nuclei templates

1
ProjectDiscoveryCRITICALMongo-Express - Remote Code ExecutionCVSS 9.8

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Remediation

Apply the latest security patches or updates provided by the vendor to fix this vulnerability.

Authorsleovalcante
Template tagscvecve2020mongoexpressrceintrusivemongo-express_projectnode.jsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:mongo-express_project:mongo-express:*:*:*:*:*:node.js:*:*
Shodan: http.title:"mongo express"
FOFA: title="mongo express"
Google: intitle:"mongo express"
https://securitylab.github.com/advisories/GHSL-2020-131-mongo-express/ https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a https://nvd.nist.gov/vuln/detail/CVE-2020-24391 https://github.com/mongodb-js/query-parser/issues/16 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3