CVE-2022-22143
📋 TL;DR
CVE-2022-22143 is a prototype pollution vulnerability in the convict configuration management library for Node.js. It allows attackers to modify object prototypes, potentially leading to denial of service, remote code execution, or privilege escalation. Any Node.js application using vulnerable versions of convict is affected.
💻 Affected Systems
- convict
📦 What is this software?
Convict by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or service disruption.
Likely Case
Denial of service through application crashes or modification of configuration behavior.
If Mitigated
Limited impact if input validation and sandboxing prevent malicious payloads from reaching convict.
🎯 Exploit Status
Exploitation requires attacker to control input to convict configuration parsing. Public proof-of-concept demonstrates prototype pollution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.2
Vendor Advisory: https://github.com/mozilla/node-convict/security/advisories/GHSA-6g2m-w6m4-h9q6
Restart Required: Yes
Instructions:
1. Update package.json to specify convict version 6.2.2 or higher. 2. Run 'npm update convict' or 'yarn upgrade convict'. 3. Restart all Node.js services using convict.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation for all configuration sources before passing to convict.
Use Object.freeze on prototypes
allFreeze Object.prototype to prevent prototype pollution attacks.
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Isolate services using vulnerable convict versions behind firewalls with strict network controls.
- Implement runtime protection tools that detect and block prototype pollution attempts.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list convict' to see installed version. If version is below 6.2.2, system is vulnerable.Check Version:
npm list convict | grep convictVerify Fix Applied:
After updating, verify version is 6.2.2 or higher with 'npm list convict' and test configuration parsing with known malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Unusual configuration changes
- Error messages related to prototype modification
Network Indicators:
- Unusual HTTP requests to configuration endpoints
- Malformed JSON payloads to configuration APIs
SIEM Query:
source="application.logs" AND ("prototype pollution" OR "convict error" OR "unexpected property")🔗 References
- https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569
- https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880
- https://snyk.io/vuln/SNYK-JS-CONVICT-2340604
- https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569
- https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880
- https://snyk.io/vuln/SNYK-JS-CONVICT-2340604
