Security Fix for Prototype Pollution - huntr.dev

[huntr-helper]

@zpbrent (https://huntr.dev/users/zpbrent) has fixed a potential Prototype Pollution vulnerability in your repository 🔨. For more information, visit our website (https://huntr.dev/) or click the bounty URL below...

Q | A
Version Affected | *
Bug Fix | YES
Original Pull Request | 418sec#1

If you are happy with this disclosure, we would love to get a CVE assigned to the vulnerability. Feel free to credit @zpbrent, the discloser found in the bounty URL (below) and @huntr-helper.

User Comments:

📊 Metadata *

mongoose.Schema() is subject to prototype pollution due to the recursively calling of Schema.prototype.add() function to add new items into the schema object. This vulnerability allows modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property. Possibly leading to many kinds of attacks such as the denial-of-service, checking bypass, or potentially code execution.

Bounty URL: https://www.huntr.dev/bounties/1-npm-mongoose/

⚙️ Description *

__proto__/constructor/prototype check in Schema.prototype.add() function in lib/schema.js.

💻 Technical Description *

Recurse propoty assignment with path must be checked to avoid to pollute to the object's propotype.

🐛 Proof of Concept (PoC) *

// PoC.js
mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED
//end of PoC.js

We find that, despite the use of HACKED in the malicious payload can pollute the Object's prototype successfully, it may incur a TypeError expection since the HACKED is not a default type the mongoose.Schema supports (see http://bit.ly/mongoose-schematypes). To avoid this TypeError, we can use any one of the supported type to replace HACKED in the payload, such as the Date, String, Number etc. Note that, restrictng the polluted payload with supported types can limit the consequent attacks, but at least, the denial of service attack to prototype functions is always possible.

🔥 Proof of Fix (PoF) *

After the fix:

//PoF.js
mongoose = require('mongoose');
mongoose.version; //'5.12.0'
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mongoose.Schema(JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // undefined
//end of PoF.js

🔗 Relates to...

https://www.huntr.dev/bounties/1-npm-mongoose/

[vkarpov15]

Thanks 👍

[JamieSlome]

@vkarpov15 - thanks for the quick turnaround!

If you are interested, you can get more disclosures/fixes like these in the future by adding our badge to your README.md:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

Have a great day! 👋

[zpbrent]

@vkarpov15 - thanks for the quick turnaround!

If you are interested, you can get more disclosures/fixes like these in the future by adding our badge to your README.md:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

Have a great day! 👋

Hi @JamieSlome the PR has been successfully merged into the maintainer's upstreaming repository, but in the huntr.dev it seems still not confirmed by the Hacktivity page at https://www.huntr.dev/bounties/hacktivity . Also, in the bounty page https://www.huntr.dev/bounties/1-npm-mongoose/ , the patch is neither claimed as approved . Please help to check what is the issue, thanks.

[JamieSlome]

Hello @zpbrent - our automation will kick in within 24 hours after the merge, and so all of this data, including hacktivity, bounty payments etc. will be updated soon.

Let me know if you have any further questions - cheers! 🍰

[zpbrent]

Hello @zpbrent - our automation will kick in within 24 hours after the merge, and so all of this data, including hacktivity, bounty payments etc. will be updated soon.

Let me know if you have any further questions - cheers! 🍰

@JamieSlome Noted and thanks, cheers!