CVE-2022-23535

2023-02-2423:15:10

CWE-502

[email protected]

web.nvd.nist.gov

litedb

.net

nosql

database

cve-2022-23535

security

vulnerability

deserialization

untrusted data

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON

LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from BsonDocument to POCO classes. When instances of an object are not the same of class, BsonMapper use a special field _type string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using Object type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.

Affected configurations

Vulners

NVD

Node

mbdavidlitedbRange<5.0.13

CPENameOperatorVersion
litedb:litedblitedblt5.0.13

CPE	Name	Operator	Version
litedb:litedb	litedb	lt	5.0.13

CNA Affected

[
  {
    "vendor": "mbdavid",
    "product": "LiteDB",
    "versions": [
      {
        "version": "< 5.0.13",
        "status": "affected"
      }
    ]
  }
]