Executive brief
Mongoose is a popular MongoDB object modeling library used to manage database interactions in Node.js applications. A prototype pollution vulnerability in the Schema.path() function could allow an attacker to modify core JavaScript object properties, potentially causing application crashes or unexpected behavior. This could impact availability of applications relying on affected Mongoose versions.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Mongoose's Schema.path() function that fails to properly sanitize input when setting schema properties. An attacker with the ability to control schema path inputs can pollute the JavaScript Object prototype, leading to denial of service or other runtime complications. The attack requires network access to the application but no authentication. Affected versions include 6.0.0 through 6.4.5 and all versions prior to 5.13.15. Patches were released in versions 6.4.6 and 5.13.15.
Affected products
- Automattic Mongoose 6.0.0 through 6.4.5, all versions before 5.13.15
Timeline
- 2022-07-29: disclosed
- 2022-07-28: patched: Fixes released in versions 6.4.6 and 5.13.15