CVE-2022-22143: Prototype Pollution in convict
Summary
CVE-2022-22143: Prototype Pollution in convict. Affects convict versions < 6.2.3. Fixed in 6.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Convict is an npm package used for handling server-side configurations. It is primarily designed for admins to manage configurations on their servers. However, a vulnerability has been discovered in Convict that allows an attacker to inject attributes into other components and override existing attributes with incompatible types, potentially leading to crashes or other malicious behavior. While the main use case of Convict is for trusted admins, there is a possibility that an unknowledgeable admin could be tricked by an attacker into introducing malicious JavaScript code into config files.
Vulnerability Detail
The vulnerability in Convict is related to prototype pollution. By injecting attributes into other components or overriding existing attributes, an attacker can manipulate the behavior of the application. This can lead to various consequences, such as unauthorized access, data manipulation, or even crashing the application. The impact of this vulnerability is significant, especially if an admin unknowingly introduces the malicious code into the configuration files. The vulnerability has been assigned a CVSS score of 8.4, indicating a high severity level.
How To Fix
Minimum fixed version
6.2.3
This is the first release that contains the fix.
npm install convict@6.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched version is the only recommended solution.
Conclusion
The vulnerability in Convict allows for prototype pollution, enabling attackers to inject malicious attributes and manipulate the behavior of the application. Upgrading to version 6.2.3 of Convict is the only solution to fix this vulnerability. Users should promptly update their Convict dependency to ensure the security of their applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for convict →
FAQ
Convict is an npm package used for managing server-side configurations.
Users who have the Convict package as a dependency in their projects and are using versions prior to 6.2.3 are affected.
Yes, this vulnerability can be exploited remotely if an attacker is able to inject malicious code into the configuration files.
There is no known public exploit for this vulnerability at the moment.
No, upgrading to the patched version is the only recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for convict.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
