Update dependency mongoose to v6 [SECURITY] #161

renovate · 2023-03-16T11:16:05Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	`5.13.13` -> `6.13.6`

GitHub Vulnerability Alerts

CVE-2022-2564

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

CVE-2022-24304

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {}
console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

CVE-2024-53900

Mongoose versions prior to 8.8.3, 7.8.3, and 6.13.5 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

CVE-2025-23061

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Release Notes

Automattic/mongoose (mongoose)

Update dependency mongoose to v6 [SECURITY] #161

Are you sure you want to change the base?

Update dependency mongoose to v6 [SECURITY] #161

Conversation

renovate bot commented Mar 16, 2023 • edited Loading

GitHub Vulnerability Alerts

Description

Proof of Concept

Impact

Release Notes

Configuration

renovate bot commented Mar 16, 2023 • edited Loading

⚠ Artifact update problem

File name: package-lock.json

renovate bot commented May 13, 2024 • edited Loading

⚠️ Artifact update problem

File name: package-lock.json

renovate bot commented Mar 16, 2023 •

edited

Loading

renovate bot commented Mar 16, 2023 •

edited

Loading

renovate bot commented May 13, 2024 •

edited

Loading