CVE-2020-7610 Deserialization of Untrusted Data in bson
Attackers can exploit improper deserialization in the BSON library to potentially execute arbitrary code by manipulating object types.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7610?
CVE-2020-7610 is a critical unsafe deserialization vulnerability in bson, published on 30 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Weakness: CWE-502
Which versions are affected by CVE-2020-7610?
2 open source packages ship an affected version, including bson. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bson npm | All versions | 1.1.4 |
bson npm | All versions | 1.1.4 |
Products include Mongodb Bson.
How do I fix CVE-2020-7610?
Upgrade bson to 1.1.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-7610 being exploited?
There is no known exploitation of CVE-2020-7610 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-7610, GHSA-v8w9-2789-6hhr, ROOT-APP-NPM-CVE-2020-7610, SNYK-JS-BSON-561052, UBUNTU-CVE-2020-7610.