Prototype Pollution in Mongoose via $set Update Casting

Executive Summary

This is a prototype pollution vulnerability in Mongoose, a MongoDB object modeling tool for Node.js. It affects versions before 6.13.10, 7.8.10, 8.24.1, and 9.7.2. The issue occurs when user-controlled updates are passed to Mongoose's update operations, such as MyModel.updateOne(filter, req.body). An attacker can manipulate the update object to include __proto__.x dotted paths, which pollutes Object.prototype by setting properties like $fullPath and $parentSchemaDocArray. This causes all newly created objects to inherit these polluted properties.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of Mongoose in your project using npm list mongoose or by inspecting your package.json file. If the version is below 6.13.10, 7.8.10, 8.24.1, or 9.7.2, the system is vulnerable. Additionally, review application code for user-controlled updates passed to Mongoose operations like updateOne or findOneAndUpdate.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to application integrity and availability impacts. Attackers could set malicious properties on Object.prototype, causing unintended behavior in objects created after the pollution. This might result in data corruption, unexpected application behavior, or denial of service. The attack requires no privileges or user interaction and can be exploited remotely.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Mongoose to version 6.13.10, 7.8.10, 8.24.1, or 9.7.2 or later. As a temporary workaround, validate user-controlled updates to ensure they do not contain __proto__ properties before passing them to Mongoose operations.

Useful 0 Not Useful 0