PT-2023-12727 · Litedb · Litedb

Highmbdavid · Published 2023-02-24 · Updated 2023-03-06 · CVE-2022-23535

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LiteDB versions prior to 5.0.13

Description The issue concerns the deserialization of untrusted data in LiteDB, a .NET NoSQL embedded database. When instances of an object are not the same class, BsonMapper uses a special field type string info with full class name with assembly to be loaded and fit into the model. If an end-user can send a plain JSON string to the app, deserialization can load an unsafe object to fit into the model.

Recommendations For versions prior to 5.0.13, consider updating to version 5.0.13 or later, which includes basic fixes to avoid this issue, although it is not 100% guaranteed when using the Object type. As a temporary workaround, avoid allowing users to send JSON strings to be directly inserted or updated into the database. Avoid using classes with the Object type; instead, try using an interface when possible. For apps that send plain JSON strings to be inserted or updated into the database, prefer using a specific type, such as IDictionary<string, string>, which will only accept key/value strings, rather than the Object base type.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-23535

GHSA-3X49-G6RC-C284

Affected Products

Litedb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23535.json · Exploit
• https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284 · Vendor Advisory
• https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f · Patch
• https://osv.dev/vulnerability/CVE-2022-23535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23535 · Security Note
• https://osv.dev/vulnerability/GHSA-3x49-g6rc-c284 · Vendor Advisory
• https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13 · Note
• https://github.com/mbdavid/LiteDB · Note
• https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2 · Note