Executive brief
The config-handler library, used for managing and merging application configuration files, is vulnerable to a security flaw that allows attackers to inject malicious properties into the application's core objects. By providing a specially crafted configuration file, an attacker could potentially crash the application, bypass security checks, or in some cases, execute unauthorized code. This affects any application that uses this library to process untrusted configuration data.
Technical details
The config-handler package is vulnerable to Prototype Pollution (CWE-1321) during the recursive merging of configuration files, including package.json, global, and environment-specific configs. The vulnerability arises because the library does not properly sanitize or restrict keys such as __proto__ or constructor.prototype when merging objects. An attacker who can control the content of a configuration file (e.g., via a malicious package.json or environment config) can inject properties into the global Object prototype. This can lead to Denial of Service (DoS), bypass of security logic, or potentially Remote Code Execution (RCE) depending on how the application uses the polluted objects. As of the latest advisory, there is no known patched version available.
Affected products
- jarradseers config-handler All versions up to 2.0.3
Timeline
- 2021-08-15: disclosed: Vulnerability reported via GitHub issue
- 2021-10-11: advisory: NVD publication date
- 2021-10-12: advisory: GitHub Advisory published