CVE-2022-21824: High severity Nodejs Node.js vulnerability
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Other sources
Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be proto. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.
Reference: https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
— Red Hat
Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table() function. An attacker could exploit this vulnerability using console.table properties to allow an empty string to be assigned to numerical keys of the object prototype.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-21824.
What is the severity of CVE-2022-21824?
The severity of CVE-2022-21824 is high (8.2).
Which software is affected by CVE-2022-21824?
The following software are affected by CVE-2022-21824: - Node.js versions up to 12.22.9 - Node.js versions up to 14.18.3 - Node.js versions up to 16.13.2 - Node.js versions up to 17.3.1 - Rh-nodejs12-nodejs versions up to 0:12.22.12-2.el7 - Rh-nodejs14-nodejs versions up to 0:14.20.1-2.el7 - Debian Node.js version 10.24.0~dfsg-1~deb10u1 - Oracle MySQL Cluster versions up to 8.0.29 - Oracle MySQL Connectors versions up to 8.0.28 - Oracle MySQL Enterprise Monitor versions up to 8.0.29 - Oracle MySQL Server versions up to 8.0.29 - Oracle MySQL Workbench versions up to 8.0.28 - Oracle PeopleSoft Enterprise PeopleTools version 8.58 - Oracle PeopleSoft Enterprise PeopleTools version 8.59 - Debian Debian Linux version 10.0 - Debian Debian Linux version 11.0 - NetApp OnCommand Insight - NetApp OnCommand Workflow Automation - Netapp Snapcenter - IBM Cognos Analytics 11.2.x - IBM Cognos Analytics 11.1.x
How does CVE-2022-21824 impact Node.js?
CVE-2022-21824 impacts Node.js by allowing user-controlled input to be passed to the 'properties' parameter of the 'console.table()' function, potentially leading to prototype pollution.
How can CVE-2022-21824 be fixed?
To fix CVE-2022-21824, it is recommended to upgrade to the following versions: - Node.js 12.22.9 - Node.js 14.18.3 - Node.js 16.13.2 Or apply the appropriate patch provided by your software vendor.