CVE-2022-21803
📋 TL;DR
CVE-2022-21803 is a prototype pollution vulnerability in the nconf configuration management library when using the memory engine. Attackers can inject malicious properties through the .set() function to modify Object.prototype, potentially leading to denial of service or remote code execution. This affects applications using nconf versions before 0.11.4.
💻 Affected Systems
- nconf
📦 What is this software?
Nconf by Nconf Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Denial of service, application crashes, or unauthorized configuration changes
If Mitigated
Limited impact if input validation and sandboxing prevent exploitation
🎯 Exploit Status
Exploitation requires control over input to nconf's .set() method and memory engine usage
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.4
Vendor Advisory: https://github.com/indexzero/nconf/releases/tag/v0.11.4
Restart Required: Yes
Instructions:
1. Update package.json to specify nconf version 0.11.4 or higher. 2. Run 'npm update nconf' or 'yarn upgrade nconf'. 3. Restart all Node.js applications using nconf.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation for all data passed to nconf's .set() method
Use alternative storage engines
allSwitch from memory engine to file, redis, or other storage engines
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all configuration data
- Use Object.freeze() on critical objects to prevent prototype pollution
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list nconf' to see if version is below 0.11.4Check Version:
npm list nconf | grep nconfVerify Fix Applied:
Verify nconf version is 0.11.4 or higher using 'npm list nconf'📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual configuration changes
- Prototype pollution error messages
Network Indicators:
- Unusual API calls to configuration endpoints
- Suspicious input patterns in HTTP requests
SIEM Query:
source="application.log" AND ("prototype pollution" OR "nconf" AND "unexpected")🔗 References
- https://github.com/indexzero/nconf/pull/397
- https://github.com/indexzero/nconf/releases/tag/v0.11.4
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450
- https://snyk.io/vuln/SNYK-JS-NCONF-2395478
- https://github.com/indexzero/nconf/pull/397
- https://github.com/indexzero/nconf/releases/tag/v0.11.4
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450
- https://snyk.io/vuln/SNYK-JS-NCONF-2395478
