fkie_cve-2022-24304

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2564. Reason: This candidate is a duplicate of CVE-2022-2564. Notes: All CVE users should reference CVE-2022-2564 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

GHSA-h8hf-x3f4-xwgp — Mongoose Vulnerable to Prototype Pollution in Schema Object

Affected: npm: mongoose

### Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the `schema` object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

### Proof of Concept ```js // poc.js const mongoose = require('mongoose'); const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {} console.log(x.toString()) // crashed (Denial of service (DoS) attack) ```

### Impact This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

Most recent entries from all

fkie_cve-2022-24304

GHSA-h8hf-x3f4-xwgp — Mongoose Vulnerable to Prototype Pollution in Schema Object

gsd-2022-24304