Mongoose search injection vulnerability
Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.
NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.
Mongoose Prototype Pollution vulnerability
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.
Sequelize vulnerable to SQL Injection via replacements
Impact
The SQL injection exploit is related to replacements. Here is such an example:
In the following query, some parameters are passed through replacements, and some are passed directly through the where option.
``typescript
User.findAll({
where: or(
literal('soundex("firstName") = soundex(:firstName)'),
{ lastName: lastName },
),
replacements: { firstName },
})
``
This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize
Unsafe fall-through in getWhereConditions
Impact
Providing an invalid value to the where option of a query caused Sequelize to ignore that option instead of throwing an error.
A finder call like the following did not throw an error:
``ts
User.findAll({
where: new Date(),
});
`
As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.
Patches
This issue has been patched in sequelize@6.28.1` &
Sequelize - Default support for “raw attributes” when using parentheses
Impact
Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL
``ts
User.findAll({
attributes: [
['count(id)', 'count']
]
});
`
Produced
`sql
SELECT count(id) AS "count" FROM "users"
`
Patches
This feature was deprecated in Sequelize 5, and using it prints a deprecation warning.
This issue has been patched in [@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize
Mongoose Vulnerable to Prototype Pollution in Schema Object
Description
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.
Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.
Proof of Concept
```js
// poc.js
const mongoose = require('mongoose');
const schema =
