GHSA-hxwc-5vw9-2w4w NoSQL Injection in loopback-connector-mongodb
Attackers can inject NoSQL queries to leak data or execute code on the database driver via unsanitized filters in the MongoDB connector.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-hxwc-5vw9-2w4w?
GHSA-hxwc-5vw9-2w4w is a SQL injection vulnerability in loopback-connector-mongodb, published on 2 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.
Recommendation
Upgrade to version 3.6.0 or later.
Which versions are affected by GHSA-hxwc-5vw9-2w4w?
2 open source packages ship an affected version, including loopback-connector-mongodb.
| Package | Affected | Fixed in |
|---|---|---|
loopback-connector-mongodb npm | All versions | 3.6.0 |
loopback-connector-mongodb npm | All versions | 3.6.0 |
How do I fix GHSA-hxwc-5vw9-2w4w?
Upgrade loopback-connector-mongodb to 3.6.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-hxwc-5vw9-2w4w being exploited?
There is no known exploitation of GHSA-hxwc-5vw9-2w4w in the wild and no public exploit code.