Executive brief
bson-objectid is a Node.js library for handling BSON ObjectID values, commonly used in MongoDB applications. An attacker can bypass ObjectID formatting validation by injecting a malicious `_bsontype` property into input objects, allowing the creation of malformed IDs that could be stored in databases or processed by downstream systems.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in the bson-objectid package version 1.3.0 and earlier. The ObjectID() function performs an early return if it detects a `_bsontype==ObjectID` property in the user-supplied input object, without validating that the remaining object structure conforms to valid ObjectID formatting. This allows an attacker to craft objects with arbitrary additional properties that pass the ObjectID check and be treated as valid when they are malformed. No authentication or special preconditions are required to exploit this; any code that constructs ObjectIDs from user-controlled input is vulnerable. An attacker can inject malformed ObjectIDs that bypass validation checks.
Affected products
- npm bson-objectid 1.3.0 and earlier
Timeline
- 2019-12-11: disclosed
- 2022-05-24: advisory