PT-2023-9237 · Mongodb · Mongodb Compass

Karman Liu · Publicado 2023-11-30 · Atualizado 2024-07-08 · CVE-2024-6376

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MongoDB Compass versions prior to 1.42.2

Description The issue is related to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling, which may allow attackers to execute malicious code on users' systems. This could potentially expose systems to code injection risks. The flaw affects the graphical user interface (GUI) of MongoDB Compass, which is widely used to query, aggregate, and analyze MongoDB data.

Recommendations For MongoDB Compass versions prior to 1.42.2, update to version 1.42.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ejson shell parser in Compass' connection handling to minimize the risk of exploitation. Avoid using the vulnerable component until a patch is available.

Correção

Code Injection

SQL injection

RCE

Enumeração de Fraquezas

CWE-94

CWE-89

CWE-20

Identificadores relacionados

BDU:2024-05275

CVE-2024-6376

GHSA-JXR4-4PRV-MH83

Produtos afetados

Mongodb Compass

Referências · 23

• https://github.com/mongodb-js/compass/commit/b1f8050d49d66be3bc499cb317a1e1de45390e51 · Nota
• https://github.com/mongodb-js/compass · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-6376 · Nota de Segurança
• https://twitter.com/the_yellow_fall/status/1809406470473318851 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-jxr4-4prv-mh83 · Aviso do Fabricante
• https://twitter.com/Dinosn/status/1809422786886091100 · Publicação no Twitter
• https://twitter.com/Brandefense/status/1810313259561746850 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-05275 · Nota de Segurança
• https://twitter.com/H4ckManac/status/1809838917203493180 · Publicação no Twitter
• https://t.me/cvenotify/85105 · Publicação no Telegram
• https://twitter.com/fridaysecurity/status/1809406905439137802 · Publicação no Twitter
• https://twitter.com/cracbot/status/1809105069494915139 · Publicação no Twitter
• https://twitter.com/iSecurity/status/1810249870789558344 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1809135747934420999 · Publicação no Twitter
• https://vuldb.com/?id.270089 · Nota