Prototype Pollution in Node.js
Summary
CVE-2022-21824: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper... Affects nodejs across 2 version ranges.
>= 2f45ad8060e13d5ac912335096d21526f2f9602b, < 4e44cbfba6bbb87aa15564ea6856a556804f71c0
< 12.22.10-r0
Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, Node.js is susceptible to various security vulnerabilities, including prototype pollution.
Vulnerability Detail
The vulnerability identified as CVE-2022-21824 is a prototype pollution issue in Node.js. It arises due to the unsafe usage of user-controlled input in the 'console.table()' function. When passing a plain object with at least one property as the first parameter and allowing user-controlled input in the 'properties' parameter, it becomes possible to pollute the prototype of the object. This pollution is limited and only allows assigning an empty string to numerical keys of the object prototype. The affected versions of Node.js (>= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1) use a null prototype for the object where these properties are being assigned.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Node.js to the fixed versions as mentioned above.
Conclusion
The prototype pollution vulnerability in Node.js (CVE-2022-21824) can have severe implications for the security and stability of applications. It is crucial to update Node.js to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object and introduce malicious properties or modify existing ones. This can lead to unexpected behavior and security issues in the application.
The prototype pollution vulnerability in Node.js can be exploited by an attacker to modify object prototypes and potentially manipulate the application's behavior. This can lead to security bypasses, data tampering, or denial of service attacks.
Node.js versions >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is essential to update Node.js to the fixed versions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes the manifest file (e.g., package-lock.json) to identify and alert in real-time for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
