Executive brief
Mongoose is a popular Node.js library for interacting with MongoDB databases. This vulnerability allows an attacker to pollute the JavaScript Object prototype through the Schema.path() function, potentially causing application crashes (denial of service), property injection, or other exploits. Applications using affected versions are at risk if they process untrusted input when defining database schemas.
Technical details
The Schema.path() function in Mongoose versions 0–5.13.14 and 6.0.0–6.4.5 is vulnerable to prototype pollution due to insufficient validation of input passed to the schema object. An attacker can supply a malicious payload (e.g., '__proto__.toString') to the schema.path() method to pollute the Object prototype. No authentication is required; the attack only requires the ability to call Schema.path() with attacker-controlled input. This can result in denial of service (application crashes), property injection, and potentially remote code execution. Fixes were released in Mongoose 5.13.15 and 6.4.6.
Affected products
- Automattic Mongoose 0 to 5.13.14, 6.0.0 to 6.4.5
Timeline
- 2022-07-09: disclosed: Vulnerability reported privately via huntr.dev
- 2022-08-26: advisory: Vulnerability published in NVD
- 2022-08-27: patched: Fixes released in Mongoose 5.13.15 and 6.4.6