CVE-2021-21422 XSS Vulnerability in mongo-express
An attacker can inject JavaScript via large document fields or media cells in mongo-express, potentially stealing data or executing commands when an admin views the content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21422?
CVE-2021-21422 is a high-severity cross-site scripting vulnerability in mongo-express, published on 21 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
Weakness: CWE-79
Which versions are affected by CVE-2021-21422?
2 open source packages ship an affected version, including mongo-express. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongo-express npm | All versions | 1.0.0-alpha.4 |
mongo-express npm | All versions | 1.0.0-alpha.4 |
Products include Mongo-Express Project Mongo-Express.
How do I fix CVE-2021-21422?
Upgrade mongo-express to 1.0.0-alpha.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-21422 being exploited?
There is no known exploitation of CVE-2021-21422 in the wild and no public exploit code.
Other vulnerabilities in mongo-express
Sources
Also known as GHSA-7p8h-86p5-wv3p.