CVE-2025-1756: MongoDB Mongosh Privilege Escalation Flaw

CVE-2025-1756 Overview

CVE-2025-1756 is a local privilege escalation vulnerability affecting MongoDB Shell (mongosh) prior to version 2.3.0. The vulnerability exists due to an untrusted search path condition (CWE-426) that allows a local attacker with low privileges to execute unauthorized actions on a user's system with elevated privileges. Exploitation requires placing a specially crafted file in the C:\node_modules\ directory on Windows systems.

This vulnerability represents a significant risk in multi-user environments where attackers with limited access can escalate their privileges by exploiting mongosh's module loading behavior.

Critical Impact

Local attackers can achieve privilege escalation through crafted files in C:\node_modules\, potentially gaining full control of the affected system with elevated privileges.

Affected Products

• MongoDB mongosh versions prior to 2.3.0
• Red Hat CodeReady Linux Builder EUS 9.4 (multiple architectures)
• Red Hat Enterprise Linux EUS 9.4 (multiple platforms including ARM64, IBM Z Systems, Power LE)
• Red Hat Enterprise Linux Server AUS 9.4
• Red Hat Enterprise Linux Update Services for SAP Solutions 9.4

Discovery Timeline

• February 27, 2025 - CVE-2025-1756 published to NVD
• April 9, 2025 - Last updated in NVD database

Technical Details for CVE-2025-1756

Vulnerability Analysis

This vulnerability stems from an untrusted search path weakness (CWE-426) in mongosh's module resolution mechanism on Windows systems. When mongosh executes, it searches for Node.js modules in predictable locations, including the root-level C:\node_modules\ directory. This directory is typically writable by users with limited privileges, creating an opportunity for attackers to inject malicious code that will be executed with the privileges of the mongosh process.

The vulnerability requires local access to the system and the ability to write files to the C:\node_modules\ directory. Once a malicious module is placed in this location, it will be loaded when mongosh is executed by a higher-privileged user or service, resulting in privilege escalation.

Root Cause

The root cause of CVE-2025-1756 is mongosh's reliance on Node.js module resolution behavior, which searches parent directories up to the root of the filesystem for node_modules folders. On Windows systems, this includes C:\node_modules\, which may have permissive access controls allowing low-privileged users to create or modify files. When mongosh resolves required modules, it may inadvertently load attacker-controlled code from this untrusted location rather than legitimate bundled modules.

Attack Vector

The attack requires local access and follows these steps:

1. An attacker with low-privilege local access identifies that mongosh is installed on the system
2. The attacker creates a malicious Node.js module in C:\node_modules\ with a name matching a module that mongosh attempts to load
3. When a higher-privileged user or automated service executes mongosh, the malicious module is loaded due to the Node.js module resolution order
4. The attacker's code executes with the privileges of the user running mongosh, achieving privilege escalation

The attack does not require user interaction beyond the victim running mongosh, and exploitation complexity is low given that the attacker only needs write access to a predictable filesystem location.

Detection Methods for CVE-2025-1756

Indicators of Compromise

• Presence of unexpected files or directories in C:\node_modules\ on Windows systems
• Creation of Node.js module files (.js, .json, package.json) in C:\node_modules\ by non-administrative users
• Suspicious mongosh process behavior or unexpected child processes spawned during mongosh execution
• File system audit logs showing write operations to C:\node_modules\ by low-privileged accounts

Detection Strategies

• Monitor file system activity in C:\node_modules\ using endpoint detection tools or Windows file auditing
• Implement application allowlisting to detect unauthorized code execution from untrusted locations
• Deploy behavioral analysis to identify mongosh processes loading modules from unexpected paths
• Review Windows Security Event logs for file creation events (Event ID 4663) targeting C:\node_modules\

Monitoring Recommendations

• Configure SentinelOne to alert on file creation or modification events in C:\node_modules\
• Enable process ancestry monitoring to detect mongosh loading modules from non-standard locations
• Implement baseline monitoring of mongosh module dependencies to identify anomalous module loading
• Set up alerts for privilege escalation patterns following mongosh execution

How to Mitigate CVE-2025-1756

Immediate Actions Required

• Upgrade mongosh to version 2.3.0 or later immediately
• Audit and remove any unexpected files from C:\node_modules\ on affected systems
• Restrict write permissions on C:\node_modules\ to administrative users only
• Review systems for signs of compromise if mongosh was running in privileged contexts
• Apply Red Hat security updates for affected Enterprise Linux distributions

Patch Information

MongoDB has addressed this vulnerability in mongosh version 2.3.0. Organizations should upgrade to this version or later to remediate the vulnerability. Red Hat has also released security updates for affected Enterprise Linux products through Red Hat Security Errata RHSA-2025:1756.

For detailed information about the fix, refer to the MongoDB Jira Issue MONGOSH-2028.

Workarounds

• Remove or rename the C:\node_modules\ directory if it is not required by other applications
• Restrict ACLs on C:\node_modules\ to prevent write access by non-administrative users
• Avoid running mongosh with elevated privileges until the patch is applied
• Consider using containerized or isolated environments for database administration tasks

# Windows: Restrict permissions on C:\node_modules (run as Administrator)
# Remove existing directory if not needed
rmdir /s /q C:\node_modules

# Or restrict write access using icacls
icacls "C:\node_modules" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F"