CVE-2024-32866GHSA-624G-8QJG-8QXF
Conform contains Prototype Pollution Vulnerability in `parseWith...` function
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.1.1, 0.9.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- edmundhung conform
fixed in 1.1.1
- @conform-to/domnpm
From 1.0.0 · fixed in 1.1.1
- @conform-to/zodnpm
From 1.0.0 · fixed in 1.1.1
- @conform-to/yupnpm
From 1.0.0 · fixed in 1.1.1
- @conform-to/zodnpm
fixed in 0.9.2
- @conform-to/yupnpm
fixed in 0.9.2
- @conform-to/domnpm
fixed in 0.9.2