Executive brief
confinit is a Node.js library used to manage application configuration from multiple sources. A prototype pollution vulnerability in its setDeepProperty function allows an attacker to inject or modify properties on the Object prototype, potentially affecting all objects created by the application and causing unexpected behavior or bypassing security checks.
Technical details
confinit through version 0.3.0 contains a prototype pollution vulnerability in the setDeepProperty function, which fails to properly validate property paths before setting nested object properties. An attacker can exploit this by providing a payload containing the __proto__ keyword, allowing them to modify properties on the Object.prototype. This vulnerability requires network access and no authentication, enabling remote code execution or application-level privilege escalation depending on how the polluted properties are used. The fix is available in version 0.4.0 and later.
Affected products
- confinit confinit through 0.3.0
Timeline
- 2020-04-07: disclosed
- 2020-03-01: patched: Fix committed to repository