CVE-2019-10758

What is mongo-express?

mongo-express is a popular open-source, Node.js-based web administration interface for MongoDB, letting operators browse databases, run queries, and manage collections through a browser instead of the command line. It is commonly deployed alongside development and even production MongoDB instances, and — like many convenience admin tools — is sometimes left exposed to the internet with weak or default authentication, making any remote code execution flaw in it especially dangerous.

Overview

CVE-2019-10758 is a Critical (9.9) remote code execution vulnerability in mongo-express before version 0.54.0. Endpoints that use MongoDB's toBSON document-serialization method can be abused to break out of the sandboxed evaluation context mongo-express uses, allowing an attacker to run arbitrary Node.js code — and therefore arbitrary OS commands — on the server hosting the tool. The project fixed the issue in version 0.54.0, released in December 2019.

Technical Details

The vulnerability arises because mongo-express evaluates certain document properties (including custom toBSON methods) using Node.js's vm module in a way that does not adequately isolate the sandbox from the host Node.js process — a well-documented weakness class, since Node's vm module is not designed to be a robust security boundary against arbitrary attacker-controlled code. An attacker who could reach the vulnerable endpoint (with low privileges, per the CVSS vector) could submit a crafted document whose toBSON evaluation escaped the sandbox and executed commands with the privileges of the mongo-express process — commonly root or a highly privileged container user in default deployments.

Discovery

Fixed by the mongo-express maintainers as part of the project's standard vulnerability-handling process ahead of the 0.54.0 release.

Exploitation Context

CISA's KEV catalog confirms real-world exploitation of this flaw. mongo-express instances left exposed to the internet — frequently alongside other misconfigured services like open Docker APIs — have been a recurring target for opportunistic cryptomining botnet campaigns, including activity publicly attributed to the Kinsing malware family, which scans broadly for exactly this class of exposed developer/admin tooling to gain initial access and deploy cryptocurrency miners.

Remediation

1. Upgrade mongo-express to version 0.54.0 or later immediately.
2. Never expose mongo-express directly to the internet; restrict access to trusted internal networks or behind a VPN and strong authentication.
3. Run mongo-express with the minimum container/OS privileges necessary rather than as root.
4. Review server and container logs for unexpected outbound connections or process spawning consistent with cryptomining malware.
5. Audit any exposed instance for compromise and rotate credentials for the underlying MongoDB deployment if exploitation is suspected.