MongoDB mongo-express Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-12-10
• EPSS: 85% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.9

[ Description ]Official description

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

CISA: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Jun 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215ExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource