CVE-2019-17426: Improper Input Validation in Automattic Mongoose
Summary
CVE-2019-17426: Improper Input Validation in Automattic Mongoose. Affects mongoose across 2 version ranges.
< 4.13.21
>= 5.0.0, < 5.7.5
Fixed in 4.13.21 or 5.7.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Automattic Mongoose is an open-source object modeling tool for MongoDB. It provides a straightforward and schema-based solution to model application data. Mongoose allows developers to define schemas with built-in type casting, validation, query building, and more. However, versions prior to 5.7.5 are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability (CVE-2019-17426) in Automattic Mongoose allows attackers to bypass access control in some applications. It occurs due to Mongoose's failure to work around a special case (_bsontype attribute) that exists in older versions of the bson parser (mongodb/js-bson project). Attackers can exploit this vulnerability by including a query object with a _bsontype attribute, which is ignored by Mongoose. For example, adding "_bsontype":"a" can interfere with a query filter. This vulnerability has a CVSS score of 9.1 (Critical).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.13.214.13.21npm install mongoose@4.13.21 -
>= 5.0.0, < 5.7.55.7.5npm install mongoose@5.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2019-17426) in Automattic Mongoose allows attackers to bypass access control in some applications. It is crucial to upgrade to Mongoose version 5.7.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mongoose →
FAQ
The vulnerability allows attackers to bypass access control in some applications that use Automattic Mongoose. This can lead to unauthorized access, data manipulation, or other security breaches.
Versions prior to 5.7.5 of Automattic Mongoose are affected by this vulnerability.
There is no known exploit available for this vulnerability at the moment.
The recommended mitigation is to upgrade to Mongoose version 5.7.5 or later.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-8687-vv9j-hgph/GHSA-8687-vv9j-hgph.json
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
