CVE-2022-21803: Prototype Pollution
A flaw was found in the nconf library when setting the configuration properties. This flaw allows an attacker to provide a crafted property, leading to prototype object pollution.
Other sources
Node.js nconf module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw when using the memory engine. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-21803?
CVE-2022-21803 is a vulnerability in the nconf library that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2022-21803?
The severity of CVE-2022-21803 is high, with a severity score of 7.3.
How does CVE-2022-21803 work?
CVE-2022-21803 is caused by a prototype pollution flaw when using the memory engine in the Node.js nconf module. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could exploit this vulnerability.
Which software is affected by CVE-2022-21803?
The software affected by CVE-2022-21803 includes the npm-nconf package version 0.11.4, IBM Cognos Analytics 11.2.x, IBM Cognos Analytics 11.1.x, and Nconf Project Nconf up to version 0.11.4.
How can I fix CVE-2022-21803?
To fix CVE-2022-21803, update to npm-nconf version 0.11.4 or apply the necessary patches provided by the respective vendors.