Prototype Pollution Vulnerability in Node.js Package on Alpine Linux
Summary
ALPINE-CVE-2022-21824: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper... Affects nodejs versions < 12.22.10-r0. Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected package, 'nodejs', is integral to many applications running on Alpine Linux, a security-oriented, lightweight Linux distribution. This vulnerability arises from the 'console.table()' function, which improperly handles user-controlled input, leading to potential prototype pollution.
Vulnerability Detail
The vulnerability, identified as CVE-2022-21824, stems from the 'console.table()' function's formatting logic. It allows user-controlled input to be passed to the 'properties' parameter while also passing a plain object with at least one property, such as 'proto'. This can lead to prototype pollution, where an empty string can be assigned to numerical keys of the object prototype. Although the control is limited, it poses a risk as it can affect the integrity of the application. The vulnerability affects Node.js versions >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled input directly to the 'properties' parameter of the 'console.table()' function. Instead, sanitize and validate the input before using it.
Conclusion
In summary, CVE-2022-21824 is a significant prototype pollution vulnerability in the Node.js package on Alpine Linux. It is crucial for developers to update their Node.js installations to the patched versions to mitigate potential risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unexpected behavior in applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to denial of service, data corruption, or other unintended behaviors in applications relying on the affected Node.js versions.
Yes, the CVSS score for this vulnerability is 8.2, indicating a high severity level.
The affected versions of Node.js are >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
