FeathersJS Socket.IO NoSQL Injection Vulnerability in MongoDB Adapter

A NoSQL injection vulnerability has been identified in FeathersJS versions 5.0.0 prior to 5.0.42. Socket.IO clients can send arbitrary JavaScript objects as the id argument to service methods such as get, patch, update, and remove. The transport layer does not validate this argument, allowing malicious objects to be injected. When the MongoDB adapter is used, these objects are processed by getObjectId() and directly incorporated into MongoDB queries as operators. For example, sending an object with the $ne operator set to null matches all documents in the collection.

Impact

Exploitation of this vulnerability allows for NoSQL injection, where an attacker can manipulate MongoDB queries to bypass application logic or access unauthorized data.

Remediation

Users can upgrade to FeathersJS version 5.0.42 or later to address this vulnerability.