GHSA-4jrm-c32x-w4jf

Source

https://github.com/advisories/GHSA-4jrm-c32x-w4jf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-4jrm-c32x-w4jf/GHSA-4jrm-c32x-w4jf.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4jrm-c32x-w4jf

Aliases

CVE-2023-0163

Published

2023-01-10T21:50:00Z

Modified

2024-11-26T18:58:52Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

convict vulnerable to Prototype Pollution

Details

Impact

An attacker can inject attributes that are used in other components
An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

Patches

The problem is patched in convict@6.2.4. Users should upgrade to convict@6.2.4.

Workarounds

No way for users to fix or remediate the vulnerability without upgrading

References

https://github.com/mozilla/node-convict/issues/410

Database specific

{
    "nvd_published_at": "2024-11-26T12:15:17Z",
    "cwe_ids": [
        "CWE-1321"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-10T21:50:00Z"
}

References

Affected packages

npm / convict

Package

Name: convict; View open source insights on deps.dev
Purl: pkg:npm/convict

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.2.4