GHSA-5mrr-rgp6-x4gr Command Injection in marsdb
Attackers can execute arbitrary system commands via unsanitized $where clauses in marsdb, requiring migration to an alternative package.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-5mrr-rgp6-x4gr?
GHSA-5mrr-rgp6-x4gr is a command injection vulnerability in marsdb, published on 3 Sep 2020. It can be exploited over the network, with no action from the victim.
Official description
All versions of marsdb are vulnerable to Command Injection. In the DocumentMatcher class, selectors on $where clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Which versions are affected by GHSA-5mrr-rgp6-x4gr?
2 open source packages ship an affected version, including marsdb.
| Package | Affected | Fixed in |
|---|---|---|
marsdb npm | From 0.0.0 | None |
marsdb npm | From 0.0.0 | None |
How do I fix GHSA-5mrr-rgp6-x4gr?
No fix has been published for GHSA-5mrr-rgp6-x4gr yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-5mrr-rgp6-x4gr being exploited?
There is no known exploitation of GHSA-5mrr-rgp6-x4gr in the wild and no public exploit code.