PT-2021-14495 · Unknown · Mongo-Express

Jafar Akhondali · Published 2021-06-21 · Updated 2021-06-29 · CVE-2021-21422

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions mongo-express versions prior to v1.0.0-alpha.4

Description The issue concerns a web-based MongoDB admin interface, where two types of XSS attacks are possible. When the content of a cell exceeds the supported size, clicking on a row will display the full document unescaped, but this requires admin interaction on the cell. Additionally, data cells identified as media are rendered as media without being sanitized, allowing for potential attacks. An unauthorized user can exploit this by sending a large amount of data in a field of a document, using a payload with embedded JavaScript to export a collection to the attacker without the admin's knowledge. Other types of attacks, such as dropping a database or collection, are also possible.

Recommendations For versions prior to v1.0.0-alpha.4, upgrade to v1.0.0-alpha.4 to resolve the issue. As a temporary workaround, consider restricting access to the affected interface until the upgrade is applied. Avoid using the interface to render media or large documents until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21422

GHSA-7P8H-86P5-WV3P

Affected Products

Mongo-Express

References · 6

• 🔥 https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p · Exploit
• 🔥 https://github.com/mongo-express/mongo-express/issues/577 · Exploit
• https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b · Patch
• https://osv.dev/vulnerability/GHSA-7p8h-86p5-wv3p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21422 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21422 · Vendor Advisory