Executive brief
Mongoose is a widely-used Node.js library for MongoDB database operations. This vulnerability allows attackers to inject malicious properties into JavaScript object prototypes through Mongoose query functions like findByIdAndUpdate(). For applications using Express.js and EJS templating, this can lead to remote code execution, potentially compromising application availability and integrity.
Technical details
This is a prototype pollution vulnerability in Mongoose's document.js module, exploitable through functions such as findByIdAndUpdate(). The root cause is improper input validation that allows attackers to inject properties into JavaScript object prototypes via specially crafted query payloads. The vulnerability is network-accessible without authentication and can trigger remote code execution in Express/EJS environments where template rendering is vulnerable to prototype-polluted properties. Patches are available in @seal-security/mongoose-fixed version 5.3.4 and in upstream Mongoose as of commit f1efabf, with the fix specifically addressing prototype pollution during object initialization.
Affected products
- Automattic mongoose 5.x before patched version
- Seal Security @seal-security/mongoose-fixed 5.3.3
Timeline
- 2023-10-17: disclosed: GHSA advisory published
- 2023-10-17: patched: @seal-security/mongoose-fixed 5.3.4 released