Executive brief
Mongoose is a popular Node.js library for interacting with MongoDB databases. A flaw in input validation allows attackers to bypass query filters by injecting a special "_bsontype" attribute into query objects, potentially letting them access unauthorized data or bypass authentication checks. Applications using Mongoose with unsanitized user input are at risk of data theft and account takeover.
Technical details
Mongoose fails to sanitize query objects containing the "_bsontype" attribute, a reserved field used internally by the BSON parser. When a query object with this attribute is passed to methods like findOne() or find(), Mongoose ignores the entire query condition, resulting in a null or wildcard filter. This is a CWE-20 (Improper Input Validation) vulnerability. The attack requires network access to a Mongoose-using application and no authentication; the attacker simply crafts a JSON payload with "_bsontype" and submits it as a query parameter. An attacker can bypass access controls, steal sensitive data, or assume other users' identities. The vulnerability was fixed in Mongoose 4.13.21 and 5.7.5 by filtering the "_bsontype" attribute before querying MongoDB.
Affected products
- Automattic Mongoose 5.0.0 through 5.7.4, and all versions prior to 4.13.21
Timeline
- 2019-10-10: disclosed
- 2019-10-22: patched: Mongoose 4.13.21 and 5.7.5 released