GHSA-wxgw-qj99-44c2 Prototype Pollution in node-forge util.setPath API
Prototype pollution in node-forge allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wxgw-qj99-44c2?
GHSA-wxgw-qj99-44c2 is a vulnerability in node-forge, published on 8 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
forge.util.setPath had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.
Patches
The forge.util.setPath API and related functions were removed in 0.10.0.
Workarounds
Don't call forge.util.setPath directly or indirectly with untrusted keys.
References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
For more information
If you have any questions or comments about this advisory:
- Open an issue in forge.
- Email us at [email protected].
Which versions are affected by GHSA-wxgw-qj99-44c2?
2 open source packages ship an affected version, including node-forge.
| Package | Affected | Fixed in |
|---|---|---|
node-forge npm | All versions | 0.10.0 |
node-forge npm | All versions | 0.10.0 |
How do I fix GHSA-wxgw-qj99-44c2?
Upgrade node-forge to 0.10.0 or later.
Is GHSA-wxgw-qj99-44c2 being exploited?
There is no known exploitation of GHSA-wxgw-qj99-44c2 in the wild and no public exploit code.