PT-2023-9752 · Mozilla · Convict
Captain-K-101
·
Published
2023-01-10
·
Updated
2025-10-15
·
CVE-2023-0163
CVSS v3.1
8.4
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Mozilla Convict versions prior to 6.2.4
Description
The issue is related to improperly controlled modification of object prototype attributes, also known as "prototype pollution." This allows an attacker to inject attributes that are used in other components or override existing attributes with ones that have incompatible types, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by administrators, and it is unlikely that an administrator would deliberately sabotage their own server. However, a situation can occur where an administrator not knowledgeable about JavaScript could be tricked by an attacker into writing malicious JavaScript code into some config files.
Recommendations
For Mozilla Convict versions prior to 6.2.4, upgrade to version 6.2.4 to resolve the issue. As a temporary workaround, consider restricting access to config files to minimize the risk of exploitation. Avoid using attributes that can be overridden with incompatible types in the affected components until the issue is resolved.
Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Convict