CVE-2022-21824 is a prototype pollution vulnerability in Node.js, affecting versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1, as well as products like Debian, NetApp, and Oracle that utilize vulnerable Node.js versions. This flaw, stemming from the "console.table()" function's formatting logic, allows an attacker to assign an empty string to numerical keys of the object prototype by manipulating user-controlled input in the "properties" parameter. With a CVSS score of 8.2 (HIGH), it presents a low attack complexity and no user interaction, potentially leading to high availability impact and low integrity impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.0.0, < 12.22.9CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 14.0.0, < 14.18.3CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 16.0.0, < 16.13.2CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 17.0.0, < 17.3.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
<= 8.0.29CPE matchmatch criteria | cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-21824
Mar 8, 2022Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter which could be "__proto__". The prototype pollution has very limited control in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9 >= 14.18.3 >= 16.13.2 and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Feb 8, 2022nodejs: Prototype pollution via console.table properties
Jan 10, 2022