Executive brief
Convict is a Node.js library used to manage application configuration with validation and schema support. A prototype pollution vulnerability allows attackers who can control configuration values to inject or override JavaScript object properties, potentially compromising application behavior, causing crashes, or enabling code execution. While the library is primarily designed for server administrators, attackers could trick less-technical admins into writing malicious configuration code.
Technical details
The vulnerability is a classic prototype pollution flaw in the .set() method, where an attacker can modify the Object prototype by passing specially crafted keys (such as "constructor.prototype.polluted"). The root cause is insufficient input validation when setting configuration properties. The attack is local-oriented (requires ability to set configuration values) but requires no privileges or user interaction once configuration is processed. An attacker can inject properties into the global object prototype that affect all object instances in the application, leading to denial of service (type confusion crashes) or potentially remote code execution if the polluted properties are leveraged in unsafe contexts. The fix in convict 6.2.4 filters out dangerous keywords including constructor, __proto__, and prototype. All versions prior to 6.2.4 are affected.
Affected products
- Mozilla convict < 6.2.4
Timeline
- 2023-01-10: disclosed: Advisory GHSA-4jrm-c32x-w4jf published
- 2023-01-10: patched: Fixed in convict 6.2.4