CVE-2021-23434: Access of Resource Using Incompatible Type (Type Confusion)

August 27, 2021 (updated January 30, 2023)

A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

References

nvd.nist.gov/vuln/detail/CVE-2021-23434

Code Behaviors & Features

Detect and mitigate CVE-2021-23434 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →