Fix Mongoose NoSQL injection vulnerability (SNYK-JS-MONGOOSE-8446504)

[devin-ai-integration]

Fix Mongoose NoSQL injection vulnerability (SNYK-JS-MONGOOSE-8446504)

Vulnerability Details

• Snyk ID: SNYK-JS-MONGOOSE-8446504
• Package: mongoose
• Current version: 4.2.4
• Fixed versions: 6.13.5, 6.13.6
• Severity: High (CVSS 8.7)
• Type: Improper Neutralization of Special Elements in Data Query Logic (NoSQL injection)

Changes Made

1. Mongoose Package Upgrade

• Upgraded mongoose from 4.2.4 to 6.13.6 (latest patched version)
• Updated package.json and package-lock.json

2. Code Compatibility Updates

• mongoose-db.js:
  • Converted callback-based code to promises for Mongoose 6.x compatibility
  • Added mongoose.set('strictQuery', false) to handle deprecation warnings
  • Updated admin user creation logic with proper error handling

3. Security Fix Implementation

• routes/index.js:
  • Added input type validation in loginHandler function
  • Implemented strict type checking to prevent object injection
  • Added proper error handling for database operations
  • Prevents NoSQL injection attacks like {"password": {"$gt": ""}}

Testing Results

• ✅ Application starts successfully with upgraded Mongoose
• ✅ Database connection established (MongoDB)
• ✅ Admin user creation works correctly
• ✅ Security Test: Malicious NoSQL injection payload now returns 401 Unauthorized
• ✅ Functionality Test: Legitimate login credentials work correctly (302 redirect)
• ✅ No regressions in application functionality

Vulnerability Resolution

The fix addresses the NoSQL injection vulnerability by:

1. Upgrading to a patched version of Mongoose (6.13.6)
2. Implementing input validation to ensure username and password are strings
3. Preventing object injection into MongoDB queries

Before fix: {"username": "[email protected]", "password": {"$gt": ""}} → 302 redirect (authentication bypass)
After fix: {"username": "[email protected]", "password": {"$gt": ""}} → 401 Unauthorized (blocked)

Link to Devin run

https://app.devin.ai/sessions/cce6ca342c4e4998a1594052be9fdced

Requested by: Shawn Azman ([email protected])

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring