Security Fix for Prototype Pollution - huntr.dev

huntr-helper commented 3 years ago

https://huntr.dev/users/arjunshibu has fixed the Prototype Pollution vulnerability 🔨. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

User Comments:

📊 Metadata *

convict is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE.

Bounty URL: https://www.huntr.dev/bounties/1-npm-convict

⚙️ Description *

Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain.

💻 Technical Description *

Fix implemented by not allowing to modify object prototype.

🐛 Proof of Concept (PoC) *

Create the following PoC file:

// poc.js
var convict = require("convict");
var obj = {};
var config = convict(obj);
console.log("Before : " + {}.polluted);
config.set("__proto__.polluted","Yes! Its Polluted");
console.log("After : " + {}.polluted);

Execute the following commands in another terminal:

npm i convict # Install affected module
node poc.js #  Run the PoC

Check the Output:

Before : undefined
After : Yes! Its Polluted

🔥 Proof of Fix (PoF) *

Prototype pollution is fixed as seen below.

pof_fix

👍 User Acceptance Testing (UAT)

I've executed unit tests.
After fix the functionality is unaffected.

colin-ife-snyk commented 3 years ago

Hey Any updates on this issue? Estimates on fix and release date?

colin-ife-snyk commented 3 years ago

Not to pester but this issue has been public for almost 2 months now with no apparent activity, and I can't seem to get in touch with any active maintainers by email. Hope this fix can be applied soon, but in any case we are looking to add this to our DB soon unless there's any objection. Thanks

dannycoates commented 3 years ago

Not to pester but this issue has been public for almost 2 months now with no apparent activity, and I can't seem to get in touch with any active maintainers by email.

sorry y'all. this repo has been in limbo and without a primary maintainer. i'm now serving as an interim. i'll be pushing a patch release to npm shortly

JamieSlome commented 3 years ago

@dannycoates - thanks for the merge and support here! 👍

If you are interested in more fixes, you can let security researchers know that they can win bounties protecting this repo by adding this badge into your README.md:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

julienw commented 3 years ago

hey @dannycoates, should we have a CWE for this vulnerability, so that github / npm warns our users?

madarche commented 2 years ago

This prototype pollution vulnerability has been more completely fixed with 3b86be0 and the publishing of convict@6.2.2 on NPM.

julienw commented 2 years ago

Thanks @madarche ! Is it possible to open a CVE or GHSA for this issue? It would be good so that github and npm warns about it.

JamieSlome commented 2 years ago

We are happy to help assign and publish a CVE for the original report here: https://www.huntr.dev/bounties/1-npm-convict/

@madarche - let me know if you would like us to take care of this 👍

madarche commented 2 years ago

@julienw @JamieSlome, I have been in contact with Snyk which has published an advisory: https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604 and has reserved a CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22143

For everyone: all versions of convict from the start up to and including 6.2.1 are vulnerable to prototype pollution. How to fix: Upgrade convict to version 6.2.2 or higher.

madarche commented 2 years ago

Additionally I've contacted the npm team. I'll report here when I have an answer.

JamieSlome commented 2 years ago

@madarche - can we add credit for @arjunshibu and also attach the original report as reference: https://www.huntr.dev/bounties/1-npm-convict

madarche commented 2 years ago

@JamieSlome I've just added credit for @arjunshibu in the advisory! Sorry for the omission, I tried to credit everyone, but I missed @arjunshibu! Sorry! But now it's fixed!

JamieSlome commented 2 years ago

Amazing, thank you so much! 👍

No apologies needed - really appreciate your time and effort on this issue.

madarche commented 2 years ago

So to be complete on this, here is the published security advisory: GHSA-x2w5-725j-gf2g

This advisory can be found independently from the Security tab of the project, but it's best to have a direct explicit link from here. Thanks to everyone involved!

madarche commented 2 years ago

I'm sorry to announce that the prototype pollution vulnerability was not fully fixed in the previous release either ☹️ Snyk Security team spotted a remaining flaw, thanks a lot. I should have thought of those cases too, sorry for that 😕

convict@6.2.3 has this vulnerability fixed and has been published to NPM.

The security advisory GHSA-x2w5-725j-gf2g has also been updated to state that all versions previous to 6.2.3 are vulnerable.

On the code side, the one and only good solution is of course to use Maps instead of Objects, but I really haven't anytime for this refactoring at this moment. But we should be safe with this last fix until this refactoring.

mozilla / node-convict