CVE-2022-21190
📋 TL;DR
CVE-2022-21190 is a prototype pollution vulnerability in the convict configuration management library for Node.js that allows attackers to modify object prototypes by bypassing the fix for CVE-2022-22143. This affects applications using convict for configuration management, potentially leading to denial of service, remote code execution, or privilege escalation. The vulnerability is exploitable when user-controlled input reaches convict's configuration parsing.
💻 Affected Systems
- convict
📦 What is this software?
Convict by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or lateral movement within the environment.
Likely Case
Denial of service through application crashes or unexpected behavior, or privilege escalation within the application context.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing configuration errors.
🎯 Exploit Status
Exploitation requires user input to reach convict's configuration parsing. Public proof-of-concept demonstrates the bypass technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.3
Vendor Advisory: https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md#623---2022-05-07
Restart Required: Yes
Instructions:
1. Update convict package to version 6.2.3 or later using npm: npm update convict@^6.2.3. 2. Restart all Node.js applications using convict. 3. Verify the update with npm list convict.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation to prevent user-controlled data from reaching convict's configuration parsing functions.
Environment isolation
allRun Node.js applications in isolated containers or sandboxes to limit potential damage from exploitation.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all configuration inputs
- Monitor application logs for unusual configuration parsing errors or crashes
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list convict to see if version is below 6.2.3Check Version:
npm list convict | grep convictVerify Fix Applied:
Verify convict version is 6.2.3 or higher with npm list convict and test configuration parsing with known malicious inputs📡 Detection & Monitoring
Log Indicators:
- Unusual configuration parsing errors
- Application crashes related to configuration loading
- Unexpected prototype modifications in logs
Network Indicators:
- Unusual configuration payloads in HTTP requests to configuration endpoints
SIEM Query:
source="application.logs" AND ("convict" OR "configuration error") AND ("__proto__" OR "constructor.prototype")🔗 References
- https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
- https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
- https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07
- https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
- https://snyk.io/vuln/SNYK-JS-CONVICT-2774757
- https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
- https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
- https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07
- https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
- https://snyk.io/vuln/SNYK-JS-CONVICT-2774757
