Is CVE-2023-0163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-0163 being exploited in the wild.

How severe is CVE-2023-0163?

Low severity, with a CVSS score of 3.1, published 10 January 2023.

Which products and versions are affected?

convict (npm) SEMVER:introduced=0,fixed=6.2.4.

Is there a fix for CVE-2023-0163?

Yes. convict (npm): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-0163 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2023-0163?

Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-0163: convict prototype pollution

CVE-2023-0163 · Severity: low · CVSS 3.1 · Published 2023-01-10

Convict is a Node.js library used to manage application configuration with validation and schema support. A prototype pollution vulnerability allows attackers who can control configuration values to inject or override JavaScript object properties, potentially compromising application behavior, causing crashes, or enabling code execution. While the library is primarily designed for server administrators, attackers could trick less-technical admins into writing malicious configuration code.

Technologies: convict (npm). Vendors: npm.

Quick answers

Is CVE-2023-0163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-0163 being exploited in the wild.
How severe is CVE-2023-0163?: Low severity, with a CVSS score of 3.1, published 10 January 2023.
Which products and versions are affected?: convict (npm) SEMVER:introduced=0,fixed=6.2.4.
Is there a fix for CVE-2023-0163?: Yes. convict (npm): upgrade to 6.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-0163 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2023-0163?: Check whether you run convict (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

convict (npm): upgrade to 6.2.4 or later
```
npm install convict@6.2.4
```

Technical details

The vulnerability is a classic prototype pollution flaw in the .set() method, where an attacker can modify the Object prototype by passing specially crafted keys (such as "constructor.prototype.polluted"). The root cause is insufficient input validation when setting configuration properties. The attack is local-oriented (requires ability to set configuration values) but requires no privileges or user interaction once configuration is processed. An attacker can inject properties into the global object prototype that affect all object instances in the application, leading to denial of service (type confusion crashes) or potentially remote code execution if the polluted properties are leveraged in unsafe contexts. The fix in convict 6.2.4 filters out dangerous keywords including constructor, __proto__, and prototype. All versions prior to 6.2.4 are affected.

Affected products

Mozilla convict < 6.2.4

Identifiers

CVE-2023-0163
GHSA-4jrm-c32x-w4jf

Timeline

2023-01-10: disclosed: Advisory GHSA-4jrm-c32x-w4jf published
2023-01-10: patched: Fixed in convict 6.2.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.