Critical Type Confusion Vulnerability in node-set-value Package

Background

The node-set-value package is a utility for setting values in JavaScript objects, allowing developers to easily manipulate object properties. It is widely used in various applications for its simplicity and effectiveness. However, certain versions of this package are vulnerable to a type confusion issue that can lead to security breaches, particularly when user-provided keys are used improperly.

Vulnerability Detail

This vulnerability, identified as CVE-2021-23440, affects the node-set-value package versions before 2.0.1 and between 3.0.0 and 4.0.1. It arises from a type confusion flaw that can allow attackers to bypass the protections established by CVE-2019-10747. The issue occurs when user-provided keys in the path parameter are treated as arrays, potentially leading to unauthorized access or manipulation of data. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to applications utilizing affected versions of the package.

sudo apt-get install --only-upgrade node-set-value

Workaround

If immediate upgrading is not feasible, consider implementing input validation to sanitize user-provided keys before they are processed by the node-set-value function. This can help mitigate the risk of type confusion. Example code:

function safeSetValue(obj, path, value) {
    if (Array.isArray(path)) {
        throw new Error('Invalid path: arrays are not allowed.');
    }
    setValue(obj, path, value);
}

Conclusion

The CVE-2021-23440 vulnerability in the node-set-value package poses a significant risk to applications that utilize affected versions. It is crucial to upgrade to a secure version to mitigate potential security threats. Additionally, implementing input validation can serve as a temporary measure to protect against this vulnerability.

See every vulnerability recorded for node-set-value →

FAQ