GHSA-6w3j-5fw6-r9vr: Low severity npm/joi vulnerability
Impact An application that passes attacker-controlled data into joi's custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named proto was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named constructor did the same to the Object function's statics. A consuming application that gates on the mere presence of a property (if (user.isAdmin)) can be made to take the wrong branch for every object it inspects.
This is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.
Patches Upgrade to version 18.2.5 or 17.13.6.
Workarounds Do not pass untrusted input into messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message }). Or validate that they don't contain any proto or constructor property.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/joito a version that resolves this vulnerability.Fixed in 18.2.5 - Upgrade
Upgrade
npm/joito a version that resolves this vulnerability.Fixed in 17.13.6 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 18.2.5 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.6 - Configuration
Do not pass attacker-controlled/untrusted data into Joi schema-construction custom message configuration via messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message }).
Joi messages()/message()/prefs({ messages })/Joi.extend({ messages })/rule({ message }) input handling = Do not pass untrusted input - Configuration
When using messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message }), validate/ensure the attacker-controlled configuration does not contain any "__proto__" or "constructor" property.
Joi schema-construction message configuration object properties = Reject keys "__proto__" and "constructor"
Event History
Frequently Asked Questions
Are applications that only validate untrusted data affected?
No. The issue is not reachable through data that joi validates. It requires untrusted input to be passed into joi schema-construction message configuration.
What attacker-controlled input path is required for exploitation?
An attacker must be able to supply data directly to messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). These settings are normally developer-written configuration, so applications that do not construct schemas from untrusted input are not exposed through this issue.
What is the practical impact if exploitation succeeds?
An attacker can add properties to Object.prototype, causing every object in the process to inherit them. This can change application behavior where code checks only for a property's presence or truthiness, such as if (user.isAdmin).
What should be done if an upgrade cannot be applied immediately?
Do not pass untrusted input into messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Upgrade to version 18.2.5 or 17.13.6 when possible.