Backport _bsontype fix to 4.x

[dyon-assessments]

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Source: MITRE

[vkarpov15]

That is true. Do you have any suggestions for what to do about this? I've considered deprecating prior versions and/or blog post similar to last year's prototype pollution vulnerability.

[vkarpov15]

Worth mentioning that this issue is fixed as of 5.7.5: https://github.com/Automattic/mongoose/blob/master/History.md#575--2019-10-14

[jdelta-RBS]

... What CVE is this?

[vkarpov15]

@jdelta-RBS I'm not aware of a CVE for this issue. Is there one?

[jdelta-RBS]

"NOTE: this CVE is about Mongoose's failure..." So maybe he just meant "vulnerability"?

[snoopysecurity]

I think the vulnerability he mentioned is CVE-2019-17426 which was fixed in 5.7.5

[jdelta-RBS]

@snoopysecurity Yeah seems right. It's always fun to have people just copy-paste stuff from a CVE entry, or auto vuln scanner, and just leave it in a GitHub ticket.
@dyon-assessments Why did you post this? If you checked the references in the CVE, there's a commit.

[bourretp]

Is there is any plan to fix version 4.x for this particular issue ?

[vkarpov15]

@bourretp not currently. Thanks for bringing this up, we will backport this fix.

What is preventing you from upgrading to 5.x?

[bourretp]

@vkarpov15 After taking a look to the 4 to 5 migration guide, the list of breaking changes is quite long. Without any time/budget to allocate to this migration, I'd rather stick with 4.x as long as it is maintained.

Thanks for the quick backport !

[vkarpov15]

@bourretp 4.x is not formally maintained anymore. We sometimes backport fixes when people ask for them, but we haven't actively worked on 4.x in over a year. You don't need to upgrade immediately, but I'd recommend you upgrade sooner rather than later. Feel free to reach out if you run into any issues upgrading!