Executive brief
convict is a configuration management library for Node.js applications. A prototype pollution vulnerability allows attackers to modify JavaScript object properties at runtime, potentially enabling denial of service, code execution, or data tampering in applications using the affected version.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in convict before version 6.2.3 that bypasses a previous patch for CVE-2022-22143. The original fix checked if paths started with "proto" or "this.constructor.prototype" but the check is incomplete; attackers can prepend arbitrary strings followed by a dot (e.g., "foo.proto" or "foo.this.constructor.prototype") to bypass the protection. The vulnerability is network-reachable if the application processes untrusted configuration input, requiring no authentication or user interaction. A successful exploit allows modification of arbitrary object properties, leading to denial of service or potential code execution depending on the application's use of the library. A complete fix was released in version 6.2.3.
Affected products
- Mozilla convict before 6.2.3
Timeline
- 2022-05-14: disclosed
- 2022-05-07: patched: Fix released in version 6.2.3