Quick answers
- Is CVE-2022-21190 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-21190 being exploited in the wild.
- How severe is CVE-2022-21190?
- Low severity, with a CVSS score of 3.1, published 14 May 2022.
- Which products and versions are affected?
- convict (npm) SEMVER:introduced=0,fixed=6.2.3.
- Is there a fix for CVE-2022-21190?
- Yes. convict (npm): upgrade to 6.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-21190 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-21190?
- Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- convict (npm): upgrade to 6.2.3 or later
npm install convict@6.2.3
Technical details
This is a prototype pollution vulnerability (CWE-1321) in convict before version 6.2.3 that bypasses a previous patch for CVE-2022-22143. The original fix checked if paths started with "proto" or "this.constructor.prototype" but the check is incomplete; attackers can prepend arbitrary strings followed by a dot (e.g., "foo.proto" or "foo.this.constructor.prototype") to bypass the protection. The vulnerability is network-reachable if the application processes untrusted configuration input, requiring no authentication or user interaction. A successful exploit allows modification of arbitrary object properties, leading to denial of service or potential code execution depending on the application's use of the library. A complete fix was released in version 6.2.3.
Affected products
- Mozilla convict before 6.2.3
Identifiers
- CVE-2022-21190
- GHSA-jjf5-wx3j-3fv7
Timeline
- 2022-05-14: disclosed
- 2022-05-07: patched: Fix released in version 6.2.3