CVE-2020-24391: 
JavaScript vulnerability analysis and mitigation

Mongo-express before version 1.0.0 contained a critical Remote Code Execution (RCE) vulnerability due to unsafe implementation of advanced syntax support. The vulnerability, tracked as CVE-2020-24391, was discovered in version 0.54.0 and potentially overlaps with CVE-2019-10769 (NVD, GitHub Security Lab).

The vulnerability stems from mongo-express's use of safer-eval to validate user-supplied JavaScript. The sandboxing capabilities of safer-eval could be easily bypassed, leading to Remote Code Execution in the context of the node server. The vulnerability received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Security Lab, NVD).

When exploited, this vulnerability allows attackers to execute arbitrary commands on the system. An attacker with valid user credentials can use this vulnerability to escalate privileges and execute code on the host. The vulnerability can be triggered through the /checkValid endpoint, which processes and executes JavaScript code from form submissions (GitHub Security Lab).

The vulnerability was fixed in mongo-express version 1.0.0-alpha.1 by changing the mongo-query-parser to version 2.0, which implements a safer parsing mechanism. Users are advised to upgrade to this version or later to mitigate the vulnerability (Mongo Express Patch).