CVE-2018-13863 js-bson vulnerable to REDoS
Attackers can cause denial of service in applications using the MongoDB BSON library by sending specially crafted strings to the Decimal128 parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13863?
CVE-2018-13863 is a high-severity denial of service vulnerability in n/a, published on 10 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Which versions are affected by CVE-2018-13863?
2 open source packages ship an affected version, including bson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bson npm | From 0.5.0 | 1.0.5 |
bson npm | From 0.5.0 | 1.0.5 |
Products include Mongodb Js-Bson.
How do I fix CVE-2018-13863?
Upgrade bson to 1.0.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-13863 being exploited?
There is no known exploitation of CVE-2018-13863 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CLSA-2026-1774225202, DEBIAN-CVE-2018-13863, GHSA-8462-q7x7-g2x4.