CVE-2022-21190

Published on: Not Yet Published

Last Modified on: 05/13/2022 09:15:00 PM UTC

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The following vulnerability was found:

This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

CVE References

Description Tags Link
Prototype Pollution in [email protected] · GitHub gist.github.com
text/html
URL Logo MISC gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
More more complete fix for prototype pollution · mozilla/[email protected] · GitHub github.com
text/html
URL Logo MISC github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
node-convict/main.js at 3b86be087d8f14681a9c889d45da7fe3ad9cd880 · mozilla/node-convict · GitHub github.com
text/html
URL Logo MISC github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
Prototype Pollution in convict | CVE-2022-21190 | Snyk snyk.io
text/html
URL Logo MISC snyk.io/vuln/SNYK-JS-CONVICT-2774757
node-convict/CHANGELOG.md at master · mozilla/node-convict · GitHub github.com
text/html
URL Logo MISC github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07

Discovery Credit

Alessio Della Libera of Snyk Security Team

Social Mentions

Source Title Posted (UTC)
Twitter Icon @CVEreport CVE-2022-21190 : This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143]… twitter.com/i/web/status/1… 2022-05-13 20:11:11
Twitter Icon @Robo_Alerts Potentially Critical CVE Detected! CVE-2022-21190 This affects the package convict before 6.2.3. This is a bypass o… twitter.com/i/web/status/1… 2022-05-13 20:56:02
Reddit Logo Icon /r/netcve CVE-2022-21190 2022-05-13 20:38:20
© CVE.report 2022 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report