Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg0N2otaGM2eC1oM3Fx

Remote Code Execution Vulnerability in NPM mongo-express

Impact

Remote code execution on the host machine by any authenticated user.

Proof Of Concept

Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:

this.constructor.constructor("return process")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')

Patches

Users should upgrade to version 0.54.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Snyk Security Advisory
CVE

For more information

If you have any questions or comments about this advisory:

Thanks

@JLLeitschuh for finding and reporting this vulnerability

Permalink: https://github.com/advisories/GHSA-h47j-hc6x-h3qq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg0N2otaGM2eC1oM3Fx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: 8 months ago


CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-h47j-hc6x-h3qq, CVE-2019-10758
References: Repository: https://github.com/mongo-express/mongo-express
Blast Radius: 21.8

Affected Packages

npm:mongo-express
Dependent packages: 11
Dependent repositories: 153
Downloads: 4,952 last month
Affected Version Ranges: < 0.54.0
Fixed in: 0.54.0
All affected versions: 0.11.0, 0.11.1, 0.11.2, 0.11.3, 0.12.0, 0.13.0, 0.14.1, 0.15.0, 0.16.1, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.23.5, 0.23.6, 0.23.7, 0.24.0, 0.25.0, 0.26.0, 0.27.1, 0.27.2, 0.27.3, 0.27.5, 0.27.6, 0.27.7, 0.27.8, 0.28.0, 0.28.1, 0.28.2, 0.28.3, 0.28.4, 0.28.5, 0.28.6, 0.28.7, 0.28.8, 0.29.0, 0.29.1, 0.29.2, 0.29.3, 0.29.4, 0.29.5, 0.29.7, 0.29.8, 0.29.9, 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18, 0.29.19, 0.29.20, 0.30.0, 0.30.1, 0.30.2, 0.30.3, 0.30.4, 0.30.6, 0.30.7, 0.30.8, 0.30.9, 0.30.10, 0.30.11, 0.30.12, 0.30.13, 0.30.14, 0.30.15, 0.30.16, 0.30.17, 0.30.18, 0.30.19, 0.30.20, 0.30.21, 0.30.22, 0.30.23, 0.30.24, 0.30.25, 0.30.26, 0.30.27, 0.30.28, 0.30.29, 0.30.31, 0.30.32, 0.30.33, 0.30.34, 0.30.35, 0.30.36, 0.30.37, 0.30.38, 0.30.39, 0.30.40, 0.30.42, 0.30.43, 0.30.44, 0.30.45, 0.30.46, 0.30.47, 0.30.48, 0.30.49, 0.30.50, 0.30.51, 0.30.52, 0.30.53, 0.30.54, 0.30.55, 0.30.56, 0.30.57, 0.30.58, 0.30.59, 0.31.0, 0.31.1, 0.31.2, 0.31.3, 0.31.4, 0.31.5, 0.32.0, 0.33.0, 0.34.0, 0.35.0, 0.37.0, 0.37.1, 0.37.2, 0.38.0, 0.39.0, 0.39.1, 0.39.2, 0.40.0, 0.41.0, 0.42.0, 0.42.1, 0.42.2, 0.42.3, 0.43.1, 0.44.0, 0.45.0, 0.46.0, 0.46.1, 0.47.0, 0.48.1, 0.49.0, 0.51.0, 0.51.1, 0.51.2, 0.52.0, 0.52.1, 0.52.2, 0.53.0
All unaffected versions: 0.54.0, 1.0.0, 1.0.1, 1.0.2