Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2022-2564
Date: July 28, 2022
Overview
Prototype Pollution in mongoose npm package aka GitHub repository automattic/mongoose prior to version 6.4.6 which can lead to Denial-of-Service (DoS).Details
Prototype Pollution vulnerability leverages the nature and ground rules of JavaScript programming language. Eventually, it allows the injection of properties into objects.PoC Details
Due to the absence of validation on the values passed into `Schema()` function an attacker can supply a malicious value by adjusting the value to include the `__proto__` property.Since there is no validation before assigning the property here to check whether the assigned argument is the Object's own property or not, the property will be directly assigned to the object, thereby polluting the Object prototype.
PoC Code
mongoose = require("mongoose");
var payload = '{"__proto__.toString": "Number"}';
console.log('Before:', {}.toString()); // [object Object]
mongoose.Schema(JSON.parse(payload));
console.log('After:', {}.toString()); // crashAffected Environments
Before 6.4.6Remediation
Object freeze - The object.freeze() method prevents any changes to the attributes of an object, meaning it can’t become polluted.Schema validation - Ensure the JSON scheme does not contain any prototypes or accessor property such as “__proto__”.
Safer alternatives for object’s creation - Create an object without the “__proto__” accessor property by using Object.create(null): Use Map instead of Object to hold key-value pairs securely.
Prevention
Update to version 6.4.6Language: JS
Good to know:
| Base Score: |
|
|---|---|
| Attack Vector (AV): | Network |
| Attack Complexity (AC): | Low |
| Privileges Required (PR): | None |
| User Interaction (UI): | None |
| Scope (S): | Unchanged |
| Confidentiality (C): | High |
| Integrity (I): | High |
| Availability (A): | High |