mongoose@3.9.4 vulnerabilities

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in document.js, via update functions such as findByIdAndUpdate(). This allows attackers to achieve remote code execution.

Note: Only applications using Express and EJS are vulnerable.

Upgrade mongoose to version 5.13.20, 6.11.3, 7.3.4 or higher.

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution in the Schema.path() function.

Note: CVE-2022-24304 is a duplicate of CVE-2022-2564.

Upgrade mongoose to version 5.13.15, 6.4.6 or higher.

mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The mongoose.Schema() function is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype.

PoC

mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

Upgrade mongoose to version 5.12.2 or higher.