CVE-2021-23438: Prototype Pollution
Node.js mpath module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-23438?
CVE-2021-23438 is a vulnerability in the Node.js mpath module that could allow a remote attacker to execute arbitrary code on the system.
How severe is CVE-2021-23438?
CVE-2021-23438 has a severity rating of 9.8 out of 10, which is considered critical.
Which software is affected by CVE-2021-23438?
The package mpath before version 0.8.4, Node.js mpath module, IBM Cognos Analytics 11.2.x, and IBM Cognos Analytics 11.1.x are affected by CVE-2021-23438.
How can CVE-2021-23438 be fixed?
To fix CVE-2021-23438, update the mpath package to version 0.8.4 or higher.
Where can I find more information about CVE-2021-23438?
More information about CVE-2021-23438 can be found at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-23438), [GitHub](https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc), [Snyk](https://snyk.io/vuln/SNYK-JS-MPATH-1577289).