Miggo Logo
Miggo Vulnerability Database
→
GHSA-rc4v-99cr-pjcm

GHSA-rc4v-99cr-pjcm: Prototype Pollution in ali-security/mongoose

10

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-rc4v-99cr-pjcm
EPSS Score
-
CWE
CWE-1321
Published
10/17/2023
Updated
10/17/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
@seal-security/mongoose-fixednpm= 5.3.35.3.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the init function's handling of document initialization. The GitHub commit shows a fix adding checks for 'proto' and 'constructor' keys in the _init helper function. The Snyk PoC demonstrates exploitation via findByIdAndUpdate() with $rename targeting proto.polluted. While findByIdAndUpdate() is the attack vector, the root vulnerable code is in document.js's init implementation that processes these updates without prototype pollution protections prior to the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility **us*s * Prototyp* Pollution in *o*um*nt.js, t*rou** *un*tions su** *s *in**yI**n*Up**t*(). *or *ppli**tions usin* *xpr*ss *n* *JS, t*is **n pot*nti*lly *llow r*mot* *o** *x**ution. ### P*t***s T** ori*in*l p*t**** v*rs

Reasoning

T** vuln*r**ility st*ms *rom t** init *un*tion's **n*lin* o* *o*um*nt initi*liz*tion. T** *it*u* *ommit s*ows * *ix ***in* ****ks *or '__proto__' *n* '*onstru*tor' k*ys in t** _init **lp*r *un*tion. T** Snyk Po* **monstr*t*s *xploit*tion vi* *in**yI*