CVE-2020-35149: Code Injection in mquery
Summary
CVE-2020-35149: Code Injection in mquery. Affects mquery versions < 3.2.3. Fixed in 3.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
mquery is an npm package that provides a query builder for MongoDB. It allows developers to construct complex queries using a fluent API. The package is widely used in Node.js applications that interact with MongoDB databases. Unfortunately, a vulnerability has been discovered in mquery versions prior to 3.2.3.
Vulnerability Detail
The vulnerability, identified as CVE-2020-35149, is a code injection vulnerability in mquery's lib/utils.js file. It arises due to a flaw in the merge or clone operation, where a special property such as 'proto' can be copied. This vulnerability can be exploited by an attacker to perform a pollution attack, potentially leading to unauthorized access, data manipulation, or remote code execution.
How To Fix
Minimum fixed version
3.2.3
This is the first release that contains the fix.
npm install mquery@3.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of mquery as soon as possible.
Conclusion
In conclusion, the code injection vulnerability in mquery versions prior to 3.2.3 can lead to unauthorized access, data manipulation, or remote code execution. It is crucial for developers to update to the fixed version of mquery (3.2.3) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mquery →
FAQ
mquery is an npm package that provides a query builder for MongoDB. It allows developers to construct complex queries using a fluent API.
This vulnerability can be exploited by an attacker to perform a pollution attack, potentially leading to unauthorized access, data manipulation, or remote code execution.
To fix this vulnerability, it is recommended to upgrade mquery to version 3.2.3 or later. This version includes a fix for the code injection vulnerability.
There is no known workaround for this vulnerability. It is essential to update to the fixed version of mquery as soon as possible.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to advisory]
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
