Executive brief
mquery is a popular Node.js database query library used in applications like Mongoose for MongoDB interaction. A flaw in its merge and clone functionality allows attackers to inject code by polluting object prototypes, potentially enabling arbitrary code execution or application logic manipulation without requiring authentication.
Technical details
The vulnerability is a prototype pollution flaw (CWE-94) in lib/utils.js of mquery versions prior to 3.2.3. During merge or clone operations, special properties such as __proto__, constructor, and prototype are incorrectly copied, allowing an attacker to pollute the Object prototype chain. The attack is network-reachable and requires no authentication or user interaction if the application processes untrusted input through these utility functions. An attacker can leverage this to inject code into inherited properties, potentially achieving code execution or denial of service depending on how the application uses the affected objects. The fix, committed on the project repository, explicitly filters out special properties during merge and clone operations.
Affected products
- npmjs mquery before 3.2.3
Timeline
- 2020-12-18: disclosed: Vulnerability published to GHSA
- 2020-12-17: patched: Fix committed to repository (commit 792e69f)