Executive brief
mpath is a widely-used Node.js library for safely accessing nested object properties. A type confusion flaw allows attackers to bypass security protections designed to prevent prototype pollution attacks (where malicious actors modify the core object prototype to affect all application objects). Successful exploitation could enable unauthorized access to sensitive data or modify application behavior.
Technical details
The vulnerability is a type confusion issue (CWE-843) in the mpath library's property access validation. The vulnerable condition `ignoreProperties.indexOf(parts[i]) !== -1` incorrectly invokes `Array.prototype.indexOf()` instead of `String.prototype.indexOf()` when `parts[i]` is an array (specifically `['__proto__']`), causing the security check to fail and return -1. This allows bypass of the CVE-2018-16490 protections that should block access to the prototype chain. No authentication or special privileges are required; the attack is network-accessible if the application uses mpath with untrusted input. The fix, available in version 0.8.4, adds validation to ensure `parts` elements are strings or numbers, throwing an error otherwise.
Affected products
- mpath mpath before 0.8.4
Timeline
- 2021-09-01: disclosed: CVE-2021-23438 published
- 2021-09-02: advisory: GHSA-p92x-r36w-9395 published
- 2021-09-02: patched: Version 0.8.4 released with fix