This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Link | Tags |
---|---|
https://snyk.io/vuln/SNYK-JS-NCONF-2395478 | third party advisory exploit |
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450 | third party advisory exploit |
https://github.com/indexzero/nconf/pull/397 | patch third party advisory issue tracking |
https://github.com/indexzero/nconf/releases/tag/v0.11.4 | third party advisory release notes |