CVE-2022-21190

Katalog CVE

CVSS 9.8 · Critical EPSS 4,0%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada mozilla convict. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

Rincian

Terbit di NVD

13 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

4,0% peluang dieksploitasi; lebih tinggi dari 90,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/mai... broken link · patch · advisory pihak ketiga
• https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75 patch · tool signature
• https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-CONVICT-2774757 exploit · advisory pihak ketiga
• https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07 broken link · release notes · tool signature