CVE-2021-23438: Mpath Authentication Bypass Vulnerability

CVE-2021-23438 Overview

A type confusion vulnerability exists in the mpath Node.js package before version 0.8.4 that enables attackers to bypass the prototype pollution fix implemented for CVE-2018-16490. The vulnerability arises from inconsistent handling of array inputs in the ignoreProperties.indexOf() method, where passing ['__proto__'] as an array element causes Array.prototype.indexOf() to be invoked instead of String.prototype.indexOf(), resulting in improper input validation and enabling prototype pollution attacks.

Critical Impact

This vulnerability allows remote attackers to bypass existing security protections and perform prototype pollution attacks, potentially leading to arbitrary code execution, denial of service, or property injection in Node.js applications using the affected mpath package.

Affected Products

• mpath_project mpath (versions before 0.8.4)
• Node.js applications using vulnerable mpath versions
• WebJars npm packages containing mpath

Discovery Timeline

• 2021-09-01 - CVE CVE-2021-23438 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23438

Vulnerability Analysis

This vulnerability represents a type confusion issue (CWE-843) that allows attackers to circumvent security controls designed to prevent prototype pollution. The flaw exists in how the mpath package handles path segment validation when determining whether to ignore certain property names like __proto__.

The core issue lies in the condition ignoreProperties.indexOf(parts[i]) !== -1, which behaves differently depending on the data type passed. When an attacker supplies ['__proto__'] (an array containing the string __proto__) instead of simply '__proto__' (a string), the JavaScript engine calls Array.prototype.indexOf() instead of String.prototype.indexOf(). Since these methods have different comparison semantics, the security check incorrectly returns -1 (not found), allowing the malicious property to bypass validation.

This bypass enables prototype pollution attacks where an attacker can inject properties into JavaScript's Object.prototype, affecting all objects in the application and potentially leading to remote code execution or denial of service conditions.

Root Cause

The root cause is improper type checking in the path parsing logic. The code assumes that path segments (parts[i]) will always be strings, but does not enforce this constraint. When an array is passed as a path segment, the different behavior of indexOf() on arrays versus strings creates a condition where security-sensitive property names can evade detection. The fix addresses this by explicitly validating that each path segment is either a string or number type before processing.

Attack Vector

An attacker can exploit this vulnerability remotely without authentication by supplying crafted input to any application endpoint that passes user-controlled data through mpath's path traversal functions. By constructing a path array containing ['__proto__'] as an element instead of the string '__proto__', the attacker can pollute the Object prototype, potentially:

1. Injecting malicious properties that affect application behavior
2. Overwriting existing properties to cause denial of service
3. Achieving remote code execution if the polluted properties are used in dangerous contexts

The following patch was applied to fix the vulnerability by enforcing strict type checking on path segments:

 
   for (var i = 0; i < parts.length; ++i) {
     part = parts[i];
+    if (typeof parts[i] !== 'string' && typeof parts[i] !== 'number') {
+      throw new TypeError('Each segment of path to `get()` must be a string or number, got ' + typeof parts[i]);
+    }
 
     if (Array.isArray(obj) && !/^\d+$/.test(part)) {
       // reading a property from the array items

Source: GitHub Commit Update

Detection Methods for CVE-2021-23438

Indicators of Compromise

• Unexpected modifications to Object.prototype properties in running Node.js applications
• Application logs showing unusual array-type inputs in path parameters
• Runtime errors or unexpected behavior caused by polluted prototype properties
• Anomalous object property access patterns in application monitoring

Detection Strategies

• Implement dependency scanning tools (such as npm audit or Snyk) to identify vulnerable mpath versions in your project dependencies
• Monitor application runtime for prototype pollution indicators using security-focused JavaScript monitoring tools
• Review application logs for unusual input patterns, particularly array inputs where strings are expected
• Deploy static analysis tools configured to detect type confusion patterns in Node.js code

Monitoring Recommendations

• Enable verbose logging for user input handling in Node.js applications using mpath
• Configure dependency vulnerability scanning in CI/CD pipelines to catch vulnerable package versions
• Implement runtime prototype integrity checks in production environments
• Set up alerts for any npm security advisories affecting mpath or related packages

How to Mitigate CVE-2021-23438

Immediate Actions Required

• Upgrade mpath to version 0.8.4 or later immediately using npm update mpath
• Run npm audit to verify the vulnerability has been addressed in your dependencies
• Review applications for any direct usage of mpath with user-controlled input
• Consider implementing input validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been fixed in mpath version 0.8.4. The patch adds explicit type checking to ensure that each path segment passed to get() is either a string or number, throwing a TypeError if other types are detected. This prevents the type confusion attack vector by rejecting array inputs before they can bypass the ignoreProperties check.

Apply the fix by updating your package.json and running:

npm install mpath@0.8.4

For additional details, see the GitHub Commit Update containing the security fix.

Workarounds

• Implement input validation at the application layer to ensure path arguments are strings before passing to mpath functions
• Use Object.freeze() on Object.prototype as a temporary mitigation against prototype pollution (may cause compatibility issues)
• Consider using alternative path traversal libraries that include built-in type checking
• If upgrading is not immediately possible, patch the vulnerability manually by adding type checks before mpath function calls

# Configuration example - Update mpath to patched version
npm install mpath@^0.8.4 --save
npm audit fix
# Verify the update
npm list mpath