Vulnerability Details : CVE-2022-21190
This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.
Products affected by CVE-2022-21190
- cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-21190
0.73%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-21190
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
Snyk |
CWE ids for CVE-2022-21190
-
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-21190
-
https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07
Page not found · GitHub · GitHubBroken Link;Release Notes;Tool Signature
-
https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
Page not found · GitHub · GitHubBroken Link;Patch;Third Party Advisory
-
https://snyk.io/vuln/SNYK-JS-CONVICT-2774757
Prototype Pollution in convict | CVE-2022-21190 | SnykExploit;Third Party Advisory
-
https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
Prototype Pollution in convict@6.2.2 · GitHubExploit;Third Party Advisory
-
https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
More more complete fix for prototype pollution · mozilla/node-convict@1ea0ab1 · GitHubPatch;Tool Signature
Jump to