GHSA-pcrw-h46h-c93h: Mongoose: sanitizeFilter not applied on countDocuments
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 6.13.11 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.8.12 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 8.24.3 - Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 9.9.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected if they use a Mongoose version earlier than 6.13.11, 7.8.12, 8.24.3, or 9.9.2, enable sanitizeFilter, and pass attacker-controlled filter values to countDocuments().
What must an attacker be able to do to exploit this?
An attacker needs to influence filter values supplied to countDocuments(). They can provide query operator objects that are processed as operators instead of literal values.
Does enabling sanitizeFilter prevent exploitation?
No. In affected versions, countDocuments() does not apply the configured sanitizeFilter defense, even when it is enabled.
What is the impact of a successful exploit?
The returned count can include documents that should not match the intended filter. This can undermine authorization decisions or other application logic that relies on the count.
What versions contain the fix?
The issue is fixed in Mongoose 6.13.11, 7.8.12, 8.24.3, and 9.9.2.