CVE-2023-0163

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still, a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. This issue affects Convict: before 6.2.4.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mozilla/node-convict/issues/410	Exploit Issue Tracking
https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*

History

15 Oct 2025, 17:51

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mozilla:convict::::::node.js::*
First Time		Mozilla Mozilla convict
References	~~() https://github.com/mozilla/node-convict/issues/410 -~~	() https://github.com/mozilla/node-convict/issues/410 - Exploit, Issue Tracking
References	~~() https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf -~~	() https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf - Vendor Advisory

Information

Published : 2024-11-26 12:15

Updated : 2025-10-15 17:51

NVD link : CVE-2023-0163

Mitre link : CVE-2023-0163

CVE.ORG link : CVE-2023-0163

JSON object : View

Products Affected

mozilla

convict

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2023-0163", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "published": "2024-11-26T12:15:17.390", "references": [{"url": "https://github.com/mozilla/node-convict/issues/410", "tags": ["Exploit", "Issue Tracking"], "source": "security@mozilla.org"}, {"url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@mozilla.org", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.\n\nThis allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n\n\nThe main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.\n\n\n\nThis issue affects Convict: before 6.2.4."}, {"lang": "es", "value": "Vulnerabilidad de modificaci\u00f3n controlada incorrectamente de atributos de prototipos de objetos (\"contaminaci\u00f3n de prototipos\") en Mozilla Convict. Esto permite a un atacante inyectar atributos que se utilizan en otros componentes o anular atributos existentes con otros que tienen un tipo incompatible, lo que puede provocar un bloqueo. El principal caso de uso de Convict es para gestionar configuraciones del lado del servidor escritas por los administradores que poseen los servidores y no por usuarios aleatorios. Por lo tanto, es poco probable que un administrador saboteara deliberadamente su propio servidor. Aun as\u00ed, puede ocurrir una situaci\u00f3n en la que un administrador que no tenga conocimientos de JavaScript pueda ser enga\u00f1ado por un atacante para que escriba el c\u00f3digo JavaScript malicioso en algunos archivos de configuraci\u00f3n. Este problema afecta a Convict: antes de la versi\u00f3n 6.2.4."}], "lastModified": "2025-10-15T17:51:38.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BC60C785-948E-48D0-9A6B-F9BEA49B9B18", "versionEndExcluding": "6.2.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}