CVE-2019-2391
📋 TL;DR
A vulnerability in MongoDB's js-bson library versions 1.1.3 and earlier allows incorrect parsing of certain JSON inputs, leading to improper BSON serialization. This can cause unexpected application behavior including potential data disclosure. Applications using the affected js-bson library for MongoDB operations in Node.js environments are impacted.
💻 Affected Systems
- MongoDB js-bson library
📦 What is this software?
Js Bson by Mongodb
⚠️ Risk & Real-World Impact
Worst Case
Data disclosure through malformed JSON causing BSON serialization errors that expose sensitive information in application responses or logs.
Likely Case
Application crashes or unexpected behavior when processing specific JSON inputs, potentially leading to denial of service or data corruption.
If Mitigated
Minimal impact with proper input validation and error handling in place, though underlying vulnerability remains.
🎯 Exploit Status
Exploitation requires sending specifically crafted JSON to applications using the vulnerable library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.4
Vendor Advisory: https://github.com/mongodb/js-bson/releases/tag/v1.1.4
Restart Required: Yes
Instructions:
1. Update package.json to specify js-bson version 1.1.4 or later. 2. Run 'npm update js-bson' or 'yarn upgrade js-bson'. 3. Restart the Node.js application.
🔧 Temporary Workarounds
Input Validation
allImplement strict JSON input validation and sanitization before passing to js-bson functions.
Error Handling
allWrap js-bson calls in try-catch blocks to prevent crashes from malformed input.
🧯 If You Can't Patch
- Implement network segmentation to isolate affected applications
- Deploy web application firewall (WAF) with JSON parsing protection rules
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list js-bson' to see if version is 1.1.3 or earlier.Check Version:
npm list js-bson | grep js-bsonVerify Fix Applied:
Confirm js-bson version is 1.1.4 or later using 'npm list js-bson' and test with known problematic JSON inputs.📡 Detection & Monitoring
Log Indicators:
- Application crashes or errors related to BSON serialization
- Unexpected JSON parsing errors in application logs
Network Indicators:
- Unusual JSON payloads sent to application endpoints
- Increased error responses from JSON processing endpoints
SIEM Query:
source="application.log" AND ("BSON" OR "serialization") AND error