CVE-2022-2564: Prototype Pollution in mongoose
Summary
CVE-2022-2564: Prototype Pollution in automattic/mongoose. Affects mongoose across 2 version ranges.
< 5.13.15
>= 6.0.0, < 6.4.6
Fixed in 5.13.15 or 6.4.6, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-2564 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mongoose is a popular MongoDB object modeling tool designed to work in an asynchronous environment. It provides a straightforward schema-based solution for modeling application data and includes features like validation, query building, and middleware support. However, prior to version 6.4.6, mongoose is susceptible to a critical vulnerability known as Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object. In the case of mongoose, this vulnerability allows an attacker to inject malicious properties into the prototype of a mongoose document, leading to potential code execution or data manipulation. This can have severe consequences, such as unauthorized access, data corruption, or even remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.13.155.13.15 -
>= 6.0.0, < 6.4.66.4.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible.
Conclusion
In conclusion, the Prototype Pollution vulnerability in mongoose can have severe consequences, including unauthorized access, data corruption, or remote code execution. It is crucial to update to version 6.4.6 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mongoose →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to potential code execution or data manipulation.
The consequences of this vulnerability can include unauthorized access, data corruption, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version of mongoose.
You can find more information about this vulnerability in the official GitHub repository of Bitnami's vulndb: https://github.com/bitnami/vulndb/tree/main/data/mongoose/BIT-mongoose-2022-2564.json
References
Related vulnerabilities
Recent vulnerabilities recorded for mongoose.
