GHSA-f5cv-xrv9-r8w7 NoSQL injection in express-cart
Attackers can exploit NoSQL injection in login handlers to extract authentication tokens and gain unauthorized access to user or admin accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-f5cv-xrv9-r8w7?
GHSA-f5cv-xrv9-r8w7 is a SQL injection vulnerability in express-cart, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of express-cart before 1.1.8 are vulnerable to NoSQL injection.
The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which allows to insert operators.
These operators can be used to extract the value of the field blindly in the same manner of a blind SQL injection. In this case, the $regex operator is used to guess each character of the token from the start.
Recommendation
Update to version 1.1.8 or later.
Which versions are affected by GHSA-f5cv-xrv9-r8w7?
2 open source packages ship an affected version, including express-cart.
| Package | Affected | Fixed in |
|---|---|---|
express-cart npm | All versions | 1.1.8 |
express-cart npm | All versions | 1.1.8 |
How do I fix GHSA-f5cv-xrv9-r8w7?
Upgrade express-cart to 1.1.8 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-f5cv-xrv9-r8w7 being exploited?
There is no known exploitation of GHSA-f5cv-xrv9-r8w7 in the wild and no public exploit code.