PT-2019-15148 · Automattic · Mongoose

Xiaofen9 · Published 2019-10-10 · Updated 2021-07-21 · CVE-2019-17426

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Automattic Mongoose versions through 5.7.4

Description The issue allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding bsontype:"a" can sometimes interfere with a query filter. This is related to Mongoose's failure to work around the bsontype special case that exists in older versions of the bson parser.

Recommendations For versions through 5.7.4, consider updating to a version that addresses this issue, as the current version allows attackers to bypass access control by exploiting the bsontype attribute in query objects. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-17426

GHSA-8687-VV9J-HGPH

Affected Products

Mongoose

References · 9

• https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-17426 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8687-vv9j-hgph · Vendor Advisory
• https://github.com/Automattic/mongoose · Note
• https://github.com/Automattic/mongoose/issues/8222 · Note
• https://github.com/Automattic/mongoose/releases/tag/4.13.21 · Note
• https://github.com/Automattic/mongoose/commit/f88eb2524b65a68ff893c90a03c04f0913c1913e · Note
• https://github.com/Automattic/mongoose/commits/4.13.21 · Note