Executive brief
confucious is a Node.js configuration management library. A prototype pollution vulnerability in its set() function allows attackers to inject malicious properties into the JavaScript object prototype, potentially leading to denial of service, remote code execution, or privilege escalation depending on how the application uses the polluted objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the set() function that fails to sanitize path-based property definitions. An attacker can supply paths like "__proto__:polluted" to inject properties into Object.prototype. This affects all versions up to 0.0.12 with no patch available. The attack requires network access if the vulnerable library processes untrusted input, and can result in arbitrary property injection affecting all objects in the application, enabling DoS through exception triggering, property injection attacks (e.g., privilege escalation via isAdmin flags), or RCE if the application evaluates injected properties.
Affected products
- confucious confucious 0.0.12 and earlier
Timeline
- 2020-08-14: disclosed
- 2020-09-01: other: NVD published
- 2021-05-06: advisory: GHSA advisory published