Executive brief
nedb is a lightweight database used in Node.js applications and web browsers to store and manage data. A security flaw allows an attacker to inject malicious data that modifies the fundamental behavior of the application's programming environment. This can lead to application crashes, unauthorized data modification, or potentially allow an attacker to take control of the server.
Technical details
A prototype pollution vulnerability exists in all versions of the nedb package. The flaw occurs because the library does not properly sanitize property names when performing database operations, specifically allowing the use of '__proto__' and 'constructor.prototype' keys. An attacker can exploit this by submitting a crafted payload through database update or insert operations to modify the global Object prototype. Successful exploitation can lead to Denial of Service (DoS) by overwriting built-in methods, property injection to bypass security checks, or Remote Code Execution (RCE) depending on how the application processes the polluted objects. As of the latest advisory, there is no official patch available for nedb.
Affected products
- nedb_project nedb All versions up to and including 1.8.0
Timeline
- 2021-06-15: disclosed: Vulnerability disclosed by Snyk Security Team
- 2021-06-15: advisory: NVD and Snyk published advisories