CVE-2016-10533: Express restify mongoose Private Data Disclosure Vulnerability
HIGHCVE-2016-10533 is a HIGH private data disclosure vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Express restify mongoose libraries in the npm ecosystem. The issue involves private data disclosure in express-restify-mongoose. Remediation is available by upgrading affected packages to version 3.1.0, 2.5.0.
CVE-2016-10533 at a Glance
How to Fix CVE-2016-10533
To remediate this vulnerability, upgrade all affected Express restify mongoose dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install express-restify-mongoose@3.1.0npm install express-restify-mongoose@2.5.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls express-restify-mongooseHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2016-10533, inspect your project dependencies using npm:
npm ls express-restify-mongooseAnalyze the terminal output to locate any version of Express restify mongoose in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.1.0), your application is affected.
Note: The npm ls express-restify-mongoose command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Express restify mongoose, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2016-10533 Affected Express restify mongoose Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
express-restify-mongoose
|
npm |
≥ 3.0.0
< 3.1.0
|
3.1.0
|
|
express-restify-mongoose
|
npm |
< 2.5.0
|
2.5.0
|
References
Frequently Asked Questions
What is CVE-2016-10533?
Which Express restify mongoose versions are affected?
What version fixes CVE-2016-10533?
Is express-restify-mongoose affected?
What CWE is associated with CVE-2016-10533?
How can I check npm dependencies for CVE-2016-10533?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cgjx-mwpx-47jv",
"modified" : "2020-08-31T18:10:32Z",
"published" : "2018-10-23T17:14:57Z",
"aliases" : [ "CVE-2016-10533" ],
"summary" : "Private Data Disclosure in express-restify-mongoose",
"details" : "Affected versions of `express-restify-mongoose` are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private.\n\n\n## Proof of Concept\n\nIf you have a user model that you want to protect, such as the following User model:\n```\nconst User = mongoose.model('User', new mongoose.Schema({\n name: String,\n password: String,\n}));\n```\n\nYou would normally do something such as:\n```\nrestify.serve(router, User, {\n private: ['password'], // Set the password part of User as private, so outside people can't read it\n})\n```\n\nThis would hide the password field from people that send your application a `GET /User` and `GET /User/some-user-id` request. \n\nA malicious user can go to your application and send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This could be used for other private data, if the malicious user knew what was set as private for specific routes.\n\n\n## Recommendation\n\nVersion 2.x: Update to version 2.5.0 or later.\nVersion 3.x: Update to version 3.1.0 or later.",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "express-restify-mongoose"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.1.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.0.1"
}
}, {
"package" : {
"ecosystem" : "npm",
"name" : "express-restify-mongoose"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.5.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.4.2"
}
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-10533"
}, {
"type" : "WEB",
"url" : "https://github.com/florianholzapfel/express-restify-mongoose/issues/252"
}, {
"type" : "WEB",
"url" : "https://github.com/florianholzapfel/express-restify-mongoose/pull/253"
}, {
"type" : "WEB",
"url" : "https://github.com/florianholzapfel/express-restify-mongoose/commit/23ccb247d0074bfaca6737cdff52d89c6d6e4a7c"
}, {
"type" : "WEB",
"url" : "https://github.com/florianholzapfel/express-restify-mongoose/commit/746defcd808e2ed1e8931dc36702b25b7db0e94b"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-cgjx-mwpx-47jv"
}, {
"type" : "WEB",
"url" : "https://www.npmjs.com/advisories/92"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2020-06-16T21:31:33Z",
"nvd_published_at" : null
}
}