Уязвимость небезопасного использования функции "console.table()" в Node.js из-за возможности подмены прототипа
Описание
В функции console.table() присутствует уязвимость, связанная с небезопасной передачей пользовательских данных в параметр properties. Эта уязвимость возникает при передаче простого объекта с как минимум одним свойством в качестве первого параметра, например, __proto__. В результате происходит подмена прототипа (prototype pollution), которая ограничивается тем, что пустая строка может быть присвоена числовым ключам прототипа объекта.
Затронутые версии ПО
- Node.js версии >= 12.22.9, >= 14.18.3, >= 16.13.2 и >= 17.3.1
Тип уязвимости
Подмена прототипа
Ссылки
- Issue TrackingMitigationThird Party Advisory
- Mailing ListThird Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Issue TrackingMitigationThird Party Advisory
- Mailing ListThird Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одно из
Одно из
EPSS
8.2 High
CVSS3
6.4 Medium
CVSS2
Дефекты
Связанные уязвимости
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Due to the formatting logic of the "console.table()" function it was n ...
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
EPSS
8.2 High
CVSS3
6.4 Medium
CVSS2