Actively exploited · Published Dec 24, 2019 · Assigned by snyk
CVE-2019-10758
Critical 9.9 Exploited
In plain English
A critical-severity code injection in mongo-express. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 84.7% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 10, 2022.
Official description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | mongo-express | 0.54.0 | GHSA-h47j-hc6x-h3qq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | mongo-express | All versions prior to version 0.54.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758 government-resource