CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
Description
CVE-2019-10758 is a critical-severity code injection vulnerability in mongo-express, a popular web-based MongoDB administration interface. Versions of mongo-express before 0.54.0 are vulnerable to remote code execution through endpoints that use the toBSON method, which improperly leverages the Node.js vm module to execute commands in an unsafe environment. An attacker with low-level authentication can exploit this flaw to execute arbitrary code on the server hosting the mongo-express instance. CISA has confirmed active exploitation by adding CVE-2019-10758 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 94.36% (99.96th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mongo-express project | mongo-express | < 0.54.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
In mongo-express, code injection manifests through the misuse of the Node.js vm module within the toBSON method. Instead of safely parsing BSON data, the application evaluates user-controlled input as executable JavaScript code, allowing attackers to break out of the intended sandbox and execute arbitrary commands on the server with the privileges of the mongo-express process.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2019-10758 carries a CVSS 3.1 score of 9.9 (CRITICAL), representing one of the highest possible severity ratings. The vulnerability is remotely exploitable over the network with low attack complexity, requires only low-level authentication, and needs no user interaction. The scope is changed, meaning exploitation can affect resources beyond the vulnerable mongo-express component itself, potentially compromising the host operating system, database contents, and other services running on the same server. Successful exploitation results in full compromise of confidentiality, integrity, and availability. With an EPSS score of 94.36%, this vulnerability is among the most actively targeted in the wild, and organizations running unpatched mongo-express instances face an imminent risk of server compromise and data breach.
Exploit Maturity
CVE-2019-10758 has confirmed active exploitation with a highly mature exploit ecosystem. Public exploit code is available via Snyk vulnerability database, which provides detailed exploitation information. CISA has confirmed active exploitation in the wild by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-06-10. The EPSS score of 94.36% indicates near-certain exploitation activity, placing CVE-2019-10758 in the top 0.04% of all CVEs by exploitation probability. The straightforward exploitation path through the toBSON endpoint, combined with the widespread deployment of mongo-express in development and production environments, makes this vulnerability particularly attractive to attackers.
Remediation
- Upgrade mongo-express to version 0.54.0 or later immediately as mandated by CISA KEV: Apply updates per vendor instructions. This version removes the unsafe vm-based code execution path.
- Verify that all instances of mongo-express (version < 0.54.0) across development, staging, and production environments have been updated, including instances running in Docker containers where outdated images may persist.
- If immediate patching is not possible, restrict network access to the mongo-express interface using firewall rules, binding it only to localhost or trusted management networks. Never expose mongo-express to the public internet.
- Review server logs for indicators of compromise, including unusual process spawning from the Node.js process, unexpected outbound network connections, and unauthorized database operations that may indicate exploitation of the toBSON endpoint.
- As a long-term hardening measure, avoid using eval(), exec(), or vm-based code execution with user-supplied input in any Node.js applications interacting with MongoDB, and consider replacing mongo-express with MongoDB Compass or other alternatives that do not expose web-based admin interfaces.
Technical Details
CVE-2019-10758 targets the toBSON method in mongo-express versions prior to 0.54.0. The vulnerability stems from the application's use of the Node.js vm module to evaluate user-supplied input as JavaScript code in what was intended to be a sandboxed environment. However, the vm module in Node.js does not provide true isolation, and attackers can escape the sandbox to execute arbitrary operating system commands via the child_process module. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that while minimal authentication is required, the attack is trivial to execute remotely and the scope change indicates that exploitation compromises resources beyond the mongo-express application itself, including the host system and potentially the MongoDB database. The near-perfect CVSS score of 9.9 underscores the combination of easy exploitability and maximum impact across all security dimensions.
Frequently Asked Questions
Is CVE-2019-10758 being actively exploited?
Yes. CVE-2019-10758 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.36% (99.96th percentile) places it among the most actively exploited vulnerabilities, with public exploit code readily available.
What products are affected by CVE-2019-10758?
CVE-2019-10758 affects mongo-express versions before 0.54.0. Mongo-express is a web-based MongoDB admin interface commonly used in development and production environments. All installations running versions prior to 0.54.0 are vulnerable regardless of the underlying operating system.
How do I fix CVE-2019-10758?
Upgrade mongo-express to version 0.54.0 or later, which addresses the code injection vulnerability in the toBSON method. Until patching is complete, restrict network access to the mongo-express web interface and ensure it is not exposed to untrusted networks.
How severe is CVE-2019-10758?
CVE-2019-10758 has a CVSS 3.1 score of 9.9 (CRITICAL), making it one of the most severe vulnerabilities possible. The combination of remote exploitability, low authentication requirements, scope change, and full impact on confidentiality, integrity, and availability demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.