mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON`
    method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
    (CVE-2019-10758)

The web-based mongo-express MongoDB admin interface before 0.54.0 is vulnerable to Remote Code Execution via endpoints that use the `toBSON` method. A misuse of the `vm` dependency allows performing `exec` commands in a non-safe environment.

The version of the mongo-express Node.js module installed on the remote host is prior to 0.54.0. It is, therefore, affected by a remote code execution vulnerability via endpoints that use the 'toBSON' method. A misuse of the `vm` dependency allows performing 'exec' commands in a non-safe environment.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
422229	SCA: security update for mongo-express (GHSA-h47j-hc6x-h3qq)	Tenable Cloud Security	SCA Checks	Local	critical
422229	SCA: security update for mongo-express (GHSA-h47j-hc6x-h3qq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
200501	Mongo-Express < 0.54.0 RCE (CVE-2019-10758)	Nessus	Misc.	Remote	critical
194908	Mongo-Express < 0.54.0 RCE	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2019-10758

critical

Tenable Plugins

critical

critical

critical

critical