Junglewise Threat Intelligence

CVE-2021-23440: set-value prototype pollution with non-string path components

CVE-2021-23440 · Severity: low · CVSS 3.1 · Published 2021-09-13

Vendors: NuGet.

Executive brief

The set-value library is a widely-used Node.js utility for setting nested properties on objects using dot-notation syntax. A type confusion flaw allows attackers to bypass prototype pollution protections by passing array values as path components instead of strings. Successful exploitation can lead to unauthorized modification of object properties, affecting application logic, data integrity, and potentially enabling remote code execution in vulnerable deployments.

Technical details

This is a prototype pollution vulnerability in set-value (CVE-2021-23440) that exploits a type confusion weakness. The vulnerability occurs when user-supplied keys in the path parameter are non-string types (such as arrays), which bypass the unsafe key validation that was added in CVE-2019-10747. An attacker can craft input with array-typed path components to pollute the Object prototype or other sensitive properties. The vulnerability affects versions 0.x through 2.0.0 (npm), 3.0.0 through 3.0.2 (npm), and 4.0.0 (npm), as well as set-value-nuget versions prior to 2.0.0. Patches were released as version 4.0.1 (npm), 3.0.3 (npm), 2.0.1 (npm), and 2.0.0 (NuGet). No authentication is required and the attack is network-accessible in applications that expose set-value functionality via user input.

Affected products

  • jonschlinkert set-value 0.0.0 to 2.0.0, 3.0.0 to 3.0.2, 4.0.0
  • NuGet set-value-nuget 0 to 1.x

Timeline

  • 2021-09-12: disclosed: Vulnerability reported and disclosed via GitHub advisory GHSA-4jqc-8m5r-9rpr
  • 2021-09-12: patched: Patches released for set-value: 4.0.1, 3.0.3, 2.0.1 and set-value-nuget 2.0.0
  • 2021-09-13: advisory: OSV and GitHub advisory published

References