CVE-2022-24304

CVE-2022-24304 · Mongoose Vulnerable to Prototype Pollution in Schema Object

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

### Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the `schema` object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack. ### Proof of Concept ```js // poc.js const mongoose = require('mongoose'); const schema = new mongoose.Schema(); malicious_payload = '__proto__.toString' schema.path(malicious_payload, [String]) x = {} console.log(x.toString()) // crashed (Denial of service (DoS) attack) ``` ### Impact This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

CVSS 9.8 · Critique · Correctif disponible

Publication

2022-08-27T00:00:54Z

Mise à jour

2024-04-22T23:44:02.962119Z

Pile logicielle: node

Vérifiez votre serveur →