Executive brief
Mongoose, a popular Node.js library for MongoDB database modeling, incorrectly handles type conversion when a number is saved to a Buffer field. This causes uninitialized memory chunks to be stored in the database, potentially exposing sensitive information such as credentials, tokens, or other secrets that happened to be in memory at the time of allocation. An attacker can retrieve this exposed data by querying the database.
Technical details
The vulnerability is a sensitive information disclosure (CWE-201) in mongoose's type casting logic for Buffer fields. When attempting to cast a numeric value to a Buffer type, the library creates a new Buffer of size equal to the numeric value without initializing its contents. This uninitialized memory is then persisted to the database, making it available to any user with database read access. The vulnerability affects versions before 3.8.39 and 4.3.6. No special privileges or network access are required beyond the ability to write to a schema field—an attacker or malicious application code can trigger this by assigning a number to a Buffer field and saving the document. The fix was to properly initialize the buffer or reject invalid type conversions.
Affected products
- Automattic mongoose 3.5.5 to 3.8.38, 4.0.0 to 4.3.5
Timeline
- 2020-09-01: disclosed: Published via GitHub Advisory
- 2016-01: patched: Fixes released in versions 3.8.39 and 4.3.6