mongoose@3.8.30 vulnerabilities

Mongoose MongoDB ODM

  • latest version

    8.8.4

  • latest non vulnerable version

  • first published

    13 years ago

  • latest version published

    7 days ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the mongoose package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Improper Neutralization of Special Elements in Data Query Logic

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic due to the improper handling of $where in match queries. An attacker can manipulate search queries to inject malicious code.

    How to fix Improper Neutralization of Special Elements in Data Query Logic?

    Upgrade mongoose to version 8.8.3 or higher.

    <8.8.3
    • H
    Prototype Pollution

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

    Note: Only applications using Express and EJS are vulnerable.

    How to fix Prototype Pollution?

    Upgrade mongoose to version 5.13.20, 6.11.3, 7.3.4 or higher.

    <5.13.20>=6.0.0-rc0 <6.11.3>=7.0.0-rc0 <7.3.4
    • H
    Prototype Pollution

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

    Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

    How to fix Prototype Pollution?

    Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

    <5.13.15>=6.0.0 <6.4.6
    • M
    Prototype Pollution

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

    PoC

    mongoose = require('mongoose');
    mongoose.version; //'5.12.0'
    var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
    console.log('Before:', {}.polluted); // undefined
    mongoose.Schema(JSON.parse(malicious_payload));
    console.log('After:', {}.polluted); // HACKED
    

    How to fix Prototype Pollution?

    Upgrade mongoose to version 5.12.2 or higher.

    <5.12.2
    • M
    Information Exposure

    mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

    Affected versions of this package are vulnerable to Information Exposure. Any query object with a _bsontype attribute is ignored, allowing attackers to bypass access control.

    How to fix Information Exposure?

    Upgrade mongoose to version 4.13.21, 5.7.5 or higher.

    <4.13.21>=5.0.0 <5.7.5
    • M
    Remote Memory Exposure

    A potential memory disclosure vulnerability exists in mongoose. A Buffer field in a MongoDB document can be used to expose sensitive information such as code, runtime memory and user data into MongoDB.

    >=3.5.5 <3.8.39>=4.0.0 <4.3.6