CVE-2021-21422
📋 TL;DR
CVE-2021-21422 is a cross-site scripting (XSS) vulnerability in mongo-express web interface that allows attackers to execute arbitrary JavaScript in admin sessions. It affects mongo-express users who view malicious database content, potentially leading to data theft or database destruction. Both authenticated and unauthenticated users can be impacted depending on configuration.
💻 Affected Systems
- mongo-express
📦 What is this software?
Mongo Express by Mongo Express Project
Mongo Express by Mongo Express Project
Mongo Express by Mongo Express Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, database/collection deletion, and full administrative control via JavaScript execution in admin context.
Likely Case
Unauthorized data access and exfiltration through malicious JavaScript payloads embedded in database fields.
If Mitigated
Limited impact with proper input validation, output encoding, and restricted database user permissions.
🎯 Exploit Status
Exploitation requires inserting malicious content into database fields, which can be done via normal database operations. No special privileges needed for initial payload insertion in many configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.0 and later
Vendor Advisory: https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p
Restart Required: Yes
Instructions:
1. Update mongo-express to version 1.0.0 or later using npm: 'npm update mongo-express' 2. Restart the mongo-express service 3. Verify the fix by checking version
🔧 Temporary Workarounds
Disable mongo-express web interface
allRemove or disable mongo-express if not required for operations
sudo systemctl stop mongo-express
sudo npm uninstall mongo-express
Network isolation
linuxRestrict access to mongo-express interface to trusted IPs only
iptables -A INPUT -p tcp --dport 8081 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all database fields
- Restrict database user permissions to read-only for application accounts
🔍 How to Verify
Check if Vulnerable:
Check mongo-express version: 'npm list mongo-express' or examine package.json. If version is below 1.0.0, system is vulnerable.Check Version:
npm list mongo-express | grep mongo-expressVerify Fix Applied:
Verify version is 1.0.0 or higher: 'npm list mongo-express | grep mongo-express' should show version >=1.0.0📡 Detection & Monitoring
Log Indicators:
- Unusual large field inserts in MongoDB logs
- JavaScript execution errors in mongo-express logs
- Unexpected database export operations
Network Indicators:
- HTTP requests with large payloads to mongo-express endpoints
- Unexpected outbound data transfers after mongo-express access
SIEM Query:
source="mongo-express" AND (message="*javascript*" OR message="*export*" OR status=500)🔗 References
- https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b
- https://github.com/mongo-express/mongo-express/issues/577
- https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p
- https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b
- https://github.com/mongo-express/mongo-express/issues/577
- https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p
