Prototype Pollution Vulnerability in Cached Path Relative Package
Summary
CVE-2021-23518: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the p... Affects node-cached-path-relative across 2 version ranges.
< 1.0.2-1+deb11u1
< 40c73bf70c58add5aec7d11e4f36b93d144bb760
Fixed in 1.0.2-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'cached-path-relative' package is a utility for resolving relative paths in a caching mechanism, commonly used in Node.js applications. It allows developers to efficiently manage file paths, enhancing performance and reducing overhead. However, prior to version 1.1.0, this package is susceptible to a prototype pollution vulnerability, which can lead to unauthorized access to object properties.
Vulnerability Detail
The vulnerability arises from the improper initialization of the cache variable in the 'cachedPathRelative' function. Instead of using 'Object.create(null)', the cache is initialized as an empty object '{}'. This allows an attacker to manipulate the prototype of the cache object, enabling access to parent prototype properties. If an attacker uses 'proto' as the origin path, they can access and modify attributes of the object instead of the intended path, potentially leading to severe security implications such as data leakage or application compromise.
How To Fix
Minimum fixed version
1.0.2-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-cached-path-relativeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to avoid using the 'cached-path-relative' package until the vulnerability is patched. Additionally, you can implement input validation to sanitize paths and prevent the use of 'proto' or other prototype manipulation techniques.
Conclusion
The 'cached-path-relative' package has a critical vulnerability that allows for prototype pollution, potentially leading to severe security risks. It is essential to upgrade to the latest version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for node-cached-path-relative →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to unauthorized access to properties and methods of all objects that inherit from that prototype.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, manipulation of application behavior, and potential full compromise of the application.
Yes, you can implement input validation to sanitize paths and avoid using the 'cached-path-relative' package until it is updated.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for node-cached-path-relative.
