Description
Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openwhyd | openwhyd | < 1.65.1 | 1.65.1 |
References
- GitHub Security Advisory (GHSA-hfg3-vq24-hprp) vendor-advisory
- Fix commit patch
- openwhyd v1.65.1 Release Notes release-notes
- Vulnerable lookup in app/models/user.js technical-description
- VulnCheck Advisory: Openwhyd before 1.65.1 NoSQL Injection via POST /api/user third-party-advisory