mongoose@5.2.7 vulnerabilities

Mongoose MongoDB ODM

Direct Vulnerabilities

Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

Note: Only applications using Express and EJS are vulnerable.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.20, 6.11.3, 7.3.4 or higher.

<5.13.20 >=6.0.0-rc0 <6.11.3 >=7.0.0-rc0 <7.3.4
  • H
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

How to fix Prototype Pollution?

Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

<5.13.15 >=6.0.0 <6.4.6
  • M
Prototype Pollution

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

PoC

mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

How to fix Prototype Pollution?

Upgrade mongoose to version 5.12.2 or higher.

<5.12.2
  • M
Information Exposure

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Information Exposure. Any query object with a _bsontype attribute is ignored, allowing attackers to bypass access control.

How to fix Information Exposure?

Upgrade mongoose to version 4.13.21, 5.7.5 or higher.

<4.13.21 >=5.0.0 <5.7.5