{"id":"GHSA-3x49-g6rc-c284","summary":"LiteDB may deserialize bad JSON on object type using _type","details":"### Impact\nLiteDB use a special field in JSON documents to cast diferent types from `BsonDocument` do POCO classes. When instance of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit in your model.\nIf your end-user can send to your app a plain JSON string, deserialization can load an unsafe  object to fit in your model.\n\n### Patches\nVersion \u003e= 5.0.13 add some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type\nNext major version will contains a allow-list to select what king of Assembly can be loaded\n\n### Workarounds\n- Avoid users send to your app a JSON string to be direct insert/update into database\n- Avoid use classes with `Object` type - try use an interface when possible\n\nIf your app send a plain JSON string to be insert/update into database, prefer this:\n```\n// Bad\npublic class Customer {\n    public int Id { get; set; }\n    public string Name { get; set; }\n    public Object AnyData { get; set; } // \u003c= Avoid use `Object` base type\n}\n\n// Good\npublic class Customer {\n    public int Id { get; set; }\n    public string Name { get; set; }\n    public IDictionary\u003cstring, string\u003e AnyData { get; set; } // Will accept only key/value strings\n}\n\n```\n\n### References\nSee this workaround fix on this commit:\n\nhttps://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f\n","aliases":["CVE-2022-23535"],"modified":"2023-11-08T04:08:21.233602Z","published":"2023-02-24T16:22:50Z","database_specific":{"github_reviewed_at":"2023-02-24T16:22:50Z","nvd_published_at":"2023-02-24T23:15:00Z","cwe_ids":["CWE-502"],"severity":"CRITICAL","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23535"},{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f"},{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2"},{"type":"PACKAGE","url":"https://github.com/mbdavid/LiteDB"},{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13"}],"affected":[{"package":{"name":"LiteDB","ecosystem":"NuGet","purl":"pkg:nuget/LiteDB"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.13"}]}],"versions":["0.5.0","0.6.0","0.8.0","0.9.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","2.0.0","2.0.0-beta","2.0.0-rc","2.0.0-rc2","2.0.1","2.0.2","2.0.3","2.0.4","3.0.0","3.0.0-beta","3.0.0-beta2","3.0.0-beta3","3.0.1","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","4.0.0","4.0.0-beta1","4.0.0-beta2","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","5.0.0","5.0.0-alpha","5.0.0-alpha2","5.0.0-beta","5.0.0-rc","5.0.1","5.0.10","5.0.11","5.0.12","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-3x49-g6rc-c284/GHSA-3x49-g6rc-c284.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}