GHSA-97mg-3cr6-3x4c Remote Code Execution in mongodb-query-parser
Attackers can execute arbitrary code by sending unsanitized queries to applications using the vulnerable mongodb-query-parser library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-97mg-3cr6-3x4c?
GHSA-97mg-3cr6-3x4c is a code injection vulnerability in mongodb-query-parser, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file:
'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'
Recommendation
Upgrade to version 2.0.0 or later.
Which versions are affected by GHSA-97mg-3cr6-3x4c?
2 open source packages ship an affected version, including mongodb-query-parser.
| Package | Affected | Fixed in |
|---|---|---|
mongodb-query-parser npm | All versions | 2.0.0 |
mongodb-query-parser npm | All versions | 2.0.0 |
How do I fix GHSA-97mg-3cr6-3x4c?
Upgrade mongodb-query-parser to 2.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-97mg-3cr6-3x4c being exploited?
There is no known exploitation of GHSA-97mg-3cr6-3x4c in the wild and no public exploit code.