CVE-2021-23438: mpath_project mpath Type Confusion

Vulnerability summary

CVE-2021-23438 is a critical (CVSS 9.8) Type Confusion vulnerability in mpath_project mpath. EPSS estimates a 1.72% chance of exploitation in the next 30 days, higher than 77.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-09-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.