PT-2022-15141 · Npm · Nconf

Alessio Della Libera · Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-21803

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions nconf versions prior to 0.11.4

Description The issue affects the nconf package when using the memory engine, allowing the storage of a nested JSON representation of the configuration. The set() function is vulnerable to Prototype Pollution, enabling the modification of properties on the Object.prototype by providing a crafted property.

Recommendations For versions prior to 0.11.4, update to version 0.11.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the set() function until a patch is available. Avoid using crafted properties that could exploit the Prototype Pollution vulnerability in the affected set() function.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-21803

GHSA-6XWR-Q98W-RVG7

SNYK-JAVA-ORGWEBJARSNPM-2632450

SNYK-JS-NCONF-2395478

Affected Products

Nconf

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-NCONF-2395478 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450 · Exploit
• https://github.com/indexzero/nconf/pull/397 · Patch
• https://osv.dev/vulnerability/CVE-2022-21803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21803 · Security Note
• https://osv.dev/vulnerability/GHSA-6xwr-q98w-rvg7 · Vendor Advisory
• https://github.com/indexzero/nconf · Note
• https://github.com/indexzero/nconf/releases/tag/v0.11.4 · Note
• https://t.me/cibsecurity/40625 · Telegram Post