Cyber Posture

CVE-2025-1756

High

Published: 27 February 2025

Published
27 February 2025
Modified
09 April 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0004 11.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-1756 is a local privilege escalation vulnerability in mongosh, affecting versions prior to 2.3.0. The flaw occurs under certain conditions when a crafted file is stored in C:\node_modules\, potentially enabling unauthorized actions on a user's system with elevated privileges. It is linked to CWE-426 (Untrusted Search Path) and carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), indicating high severity with local access required, high complexity, low privileges, and user interaction.

A local attacker with low privileges can exploit this vulnerability by placing a crafted file in the C:\node_modules\ directory. Exploitation demands high attack complexity and relies on user interaction, likely involving the execution of mongosh in an environment that loads the malicious file via an untrusted search path. Upon success, the attacker achieves privilege escalation, resulting in high impacts to confidentiality, integrity, and availability across the system's scope.

MongoDB's advisory at https://jira.mongodb.org/browse/MONGOSH-2028 and Red Hat's errata at https://access.redhat.com/errata/RHSA-2025:1756 detail the issue. Mitigation requires upgrading to mongosh 2.3.0 or later, which addresses the vulnerability.

Details

CWE(s)
CWE-426

Affected Products

mongodb
mongosh
≤ 2.3.0
redhat
codeready linux builder eus
9.4
redhat
codeready linux builder for arm64 eus
9.4_aarch64
redhat
codeready linux builder for ibm z systems eus
9.4_s390x
redhat
codeready linux builder for power little endian eus
9.4_ppc64le
redhat
enterprise linux update services for sap solutions
9.4
redhat
enterprise linux eus
9.4
redhat
enterprise linux for arm 64
9.4_aarch64
redhat
enterprise linux for arm 64 eus
9.4_aarch64
redhat
enterprise linux for ibm z systems
9.4_s390x
+3 more product configuration(s) — see NVD for full list

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

CVE-2025-1756 enables local privilege escalation in mongosh via a crafted file in C:\node_modules\, facilitating exploitation for privilege escalation.

References