MongoDB · mongo-express
The mongo-express web-based MongoDB administration interface, before version 0.54.0, contains a remote code execution flaw in endpoints that use the toBSON method, where the vm dependency is misused to run exec commands in a non-safe environment. An attacker with network access and low-privilege credentials, requiring no user interaction, can execute arbitrary code, with the scope changing beyond the vulnerable component.
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
First seen exploited 10 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Exploited through network-exposed web application endpoints
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints
Attacker achieves arbitrary command execution via vm
A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: mongo-express.
Upgrade to 0.54.0 or later
npm install mongo-express@0.54.0The first fix for CVE-2019-10758. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 0.54.0 | 0.54.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.