PT-2022-17426 · Mongoose · Mongoose

Vkarpov15 · Published 2022-07-28 · Updated 2024-03-12 · CVE-2022-2564

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions mongoose versions prior to 6.4.6

Description The issue concerns a Prototype Pollution vulnerability in the mongoose package, a MongoDB object modeling tool. This vulnerability affects the Schema.path() function, allowing modification of the Object prototype, which could potentially lead to a Denial of Service (DoS) attack.

Recommendations For versions prior to 6.4.6, update to version 6.4.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Schema.path() function until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BIT-MONGOOSE-2022-2564

CVE-2022-2564

GHSA-F825-F98C-GJ3G

Affected Products

Mongoose

References · 15

• 🔥 https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2564.json · Exploit
• 🔥 https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd · Exploit
• https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8 · Patch
• https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6 · Patch
• https://osv.dev/vulnerability/CVE-2022-2564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2564 · Security Note
• https://osv.dev/vulnerability/BIT-mongoose-2022-2564 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f825-f98c-gj3g · Vendor Advisory
• https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md · Note
• https://github.com/Automattic/mongoose/commit/99b418941e2fc974199b8e5bd9d382bb50bf680a · Note
• https://github.com/automattic/mongoose · Note
• https://t.me/cvenotify/73596 · Telegram Post
• https://t.me/cibsecurity/47245 · Telegram Post
• https://t.me/cvenotify/33956 · Telegram Post