Joi Message Prototype Pollution in compile() and merge()

Executive Summary

This is a prototype pollution vulnerability in the Joi library versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1. It occurs in lib/messages.js where the compile() and merge() functions fail to reject a __proto__ language key. Attackers can supply untrusted message configuration via methods like any().messages(), prefs, validate options, or Joi.extend to replace the compiled messages prototype. This may alter or break validation error rendering and dependent logic.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of Joi in your project using npm list joi or grep for joi in package.json. Versions 17.13.6 to 17.13.8 and 18.2.5 to 18.3.0 are vulnerable. Review code that uses any().messages(), prefs, validate options, or Joi.extend for untrusted input handling.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to manipulate the prototype chain of the application. This might cause logic errors if the application checks for property existence, such as bypassing security checks or altering application behavior. It could also break validation error rendering, leading to incorrect or misleading error messages.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Joi to version 17.13.9 or 18.3.1 or later. If updating is not possible, avoid passing untrusted input to message configuration functions like any().messages(), prefs, validate options, or Joi.extend. Validate input to exclude __proto__ or constructor properties.

Useful 0 Not Useful 0