GHSA-gg4r-jv3p-qx3c: Mongoose: Connection-level sanitizeFilter not applied
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose stores the connection-level sanitizeFilter option in Connection.config, but Query.prototype.castConditions() and query casting check other option locations and do not read that configuration. An application that enables sanitizeFilter through mongoose.connect() or createConnection() and passes an attacker-controlled object into a query filter therefore receives a connection that reports the defense as enabled while query selector objects remain unsanitized. A crafted password value using a query operator can match an account record without the expected literal password, while global configuration through mongoose.set('sanitizeFilter') and per-query Model.find().sanitizeFilter() remain unaffected. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 6.13.12 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.8.13 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 8.24.7 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 9.11.4
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use Mongoose versions from 6.0.0 up to the fixed releases, enable sanitizeFilter only through mongoose.connect() or createConnection(), and pass attacker-controlled objects into query filters. Applications using mongoose.set('sanitizeFilter') globally or per-query Model.find().sanitizeFilter() are not affected by this configuration-handling flaw.
What does an attacker need to exploit it?
An attacker needs a way to supply an object that is used as a query filter or filter value. A crafted value containing a query operator, such as for a password field, can cause a query to match an account without requiring the expected literal password.
How can this be mitigated before upgrading?
Configure sanitizeFilter globally with mongoose.set('sanitizeFilter') or enable it on each relevant query with Model.find().sanitizeFilter(). Do not rely solely on sanitizeFilter set through mongoose.connect() or createConnection().
Which versions contain fixes?
Fixed releases are 6.13.12, 7.8.13, 8.24.7, and 9.11.4.