Executive brief
express-restify-mongoose is a Node.js library that exposes MongoDB models as REST APIs with field-level access control. A flaw in the distinct query parameter allows attackers to bypass the private field restrictions and retrieve sensitive data—such as passwords—that the application owner marked as private. This data leakage affects all applications using affected versions without patches.
Technical details
The vulnerability is an information disclosure (CWE-200) in the distinct query parameter handling. Despite fields being marked as private in the restify configuration, the distinct parameter allows direct querying of those fields, bypassing access control checks. The attack is unauthenticated and network-accessible; an attacker simply appends ?distinct=fieldname to a GET request to retrieve all values of a supposedly private field from the database. This allows extraction of passwords, tokens, or other sensitive data that developers intended to hide. Patches are available in version 2.5.0 (for 2.x branch) and 3.1.0 (for 3.x branch).
Affected products
- express-restify-mongoose contributors express-restify-mongoose < 2.5.0, >= 3.0.0 and < 3.1.0
Timeline
- 2016-02-13: disclosed: Issue #252 reported on GitHub
- 2016: patched: Fixes released in versions 2.5.0 and 3.1.0
- 2018-10-23: advisory: GHSA-cgjx-mwpx-47jv published