PT-2019-4513 · Mongodb · Mongo-Express

Jonathan Leitschuh · Published 2019-10-14 · Updated 2025-03-13 · CVE-2019-10758

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mongo-express versions prior to 0.54.0

Description The issue is related to incorrect code generation management in the Mongo-express web interface for MongoDB database management. It allows a remote attacker to execute arbitrary code in the target system by sending a specially crafted request. The vulnerability is exploited via endpoints that use the toBSON method, which misuses the vm dependency to perform exec commands in a non-safe environment. This can lead to remote code execution on the host machine by any authenticated user.

Recommendations For versions prior to 0.54.0, upgrade to version 0.54.0 to resolve the issue. As a temporary workaround, consider restricting access to endpoints that use the toBSON method until the upgrade is applied. Avoid using the toBSON method in sensitive operations until the issue is resolved.

Exploit

Fix

RCE

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

BDU:2020-00407

CVE-2019-10758

GHSA-H47J-HC6X-H3QQ

SNYK-JS-MONGOEXPRESS-473215

Affected Products

Mongo-Express

References · 16

• 🔥 https://github.com/masahiro331/CVE-2019-10758 · Exploit
• 🔥 https://github.com/lp008/CVE-2019-10758 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10758 · Security Note
• https://bdu.fstec.ru/vul/2020-00407 · Security Note
• https://osv.dev/vulnerability/GHSA-h47j-hc6x-h3qq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10758 · Vendor Advisory
• https://github.com/mongo-express/mongo-express/commit/d8c9bda46a204ecba1d35558452685cd0674e6f2 · Note
• https://github.com/mongo-express/mongo-express/blob/ea02b364d43f179f191fc91fb9962efdb0843a8d/lib/bson.js#L60 · Note
• https://github.com/mongo-express/mongo-express · Note
• https://github.com/mongo-express/mongo-express/commit/7d365141deadbd38fa961cd835ce68eab5731494 · Note
• https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq · Note
• https://github.com/mongo-express/mongo-express/pull/522 · Note
• https://github.com/mongodb-js/mongodb-extjson#note-this-libray-has-been-merged-into-the-4x-version-of-the-bson-package-and-is-no-longer-being-maintained-as-a-standalone-package · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758 · Note