Merge pull request #8 from endorlabs/mpath1

Mpath CVE-2021-23438
endorlabs · Aug 2, 2024 · 6165ca5 · 6165ca5
2 parents ab2f89c + 416e2fa
commit 6165ca5
Show file tree

Hide file tree

Showing 4 changed files with 202 additions and 19 deletions.
diff --git a/minimist_vuln2.js b/minimist_vuln2.js
@@ -0,0 +1 @@
+const argv = require('minimist')(process.argv.slice(2))
diff --git a/mpath.js b/mpath.js
@@ -0,0 +1,5 @@
+// CVE-2021-23438
+
+var mu = require('mongoose/lib/utils');
+var val = mu.getValue("/foo", {}, null);
+console.log("value is "+val);
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -11,6 +11,7 @@
   "description": "",
   "dependencies": {
     "minimist": "1.2.5",
+    "mongodb": "^3.5.9",
     "mongoose": "4.2.4"
   }
 }
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		const argv = require('minimist')(process.argv.slice(2))