Quick answers
- Is CVE-2019-17426 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-17426 being exploited in the wild.
- How severe is CVE-2019-17426?
- Low severity, with a CVSS score of 3.1, published 22 October 2019.
- Which products and versions are affected?
- mongoose (npm) SEMVER:introduced=5.0.0,fixed=5.7.5.
- Is there a fix for CVE-2019-17426?
- Yes. mongoose (npm): upgrade to 5.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-17426 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-17426?
- Check whether you run mongoose (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mongoose (npm): upgrade to 5.7.5 or later
npm install mongoose@5.7.5
Technical details
Mongoose fails to sanitize query objects containing the "_bsontype" attribute, a reserved field used internally by the BSON parser. When a query object with this attribute is passed to methods like findOne() or find(), Mongoose ignores the entire query condition, resulting in a null or wildcard filter. This is a CWE-20 (Improper Input Validation) vulnerability. The attack requires network access to a Mongoose-using application and no authentication; the attacker simply crafts a JSON payload with "_bsontype" and submits it as a query parameter. An attacker can bypass access controls, steal sensitive data, or assume other users' identities. The vulnerability was fixed in Mongoose 4.13.21 and 5.7.5 by filtering the "_bsontype" attribute before querying MongoDB.
Affected products
- Automattic Mongoose 5.0.0 through 5.7.4, and all versions prior to 4.13.21
Identifiers
- CVE-2019-17426
- GHSA-8687-vv9j-hgph
Timeline
- 2019-10-10: disclosed
- 2019-10-22: patched: Mongoose 4.13.21 and 5.7.5 released