PT-2019-15930 · Mongodb · Bson-Objectid

Published 2019-12-11 · Updated 2022-05-24 · CVE-2019-19729

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions bson-objectid package version 1.3.0

Description An issue in the bson-objectid package allows an attacker to generate a malformed objectid by inserting an additional property to the user-input. This occurs because bson-objectid returns early if it detects bsontype==ObjectID in the user-input object, enabling objects in arbitrary forms to bypass formatting if they have a valid bsontype.

Recommendations For bson-objectid package version 1.3.0, consider restricting the input to the ObjectID() function to prevent the insertion of additional properties, until a patch is available. As a temporary workaround, validate user-input objects to ensure they do not contain a valid bsontype that could bypass formatting. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-670

CWE-20

Related Identifiers

CVE-2019-19729

GHSA-P84X-5XX8-HFF9

Affected Products

Bson-Objectid

References · 6

• 🔥 https://github.com/williamkapke/bson-objectid/issues/30 · Exploit
• https://osv.dev/vulnerability/GHSA-p84x-5xx8-hff9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19729 · Security Note
• https://github.com/cabinjs/bson-objectid · Note
• https://npmjs.com/package/bson-objectid · Note