Executive brief
nconf is a popular Node.js configuration management library. The memory engine is vulnerable to prototype pollution, allowing an attacker to inject arbitrary properties into JavaScript's Object.prototype through specially crafted configuration keys. This can lead to unexpected application behavior, bypass of security checks, or denial of service by poisoning the runtime environment of applications relying on this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the .set() function of nconf's memory store. When processing nested JSON configuration properties, the function fails to properly validate property names, allowing attackers to set properties like "__proto__" or "constructor.prototype" that pollute the global Object.prototype. No authentication is required; an attacker with the ability to call the .set() function with untrusted input can exploit this. The attack surface depends on how the application uses nconf—if configuration is sourced from user input, command-line arguments, or untrusted files, the vulnerability is remotely exploitable. The fix was released in version 0.11.4 and included input validation to prevent prototype pollution.
Affected products
- nconf nconf before 0.11.4
Timeline
- 2022-04-13: disclosed: GHSA-6xwr-q98w-rvg7 published
- 2022-04-10: patched: Fix merged in PR #397, released in v0.11.4