CVE-2022-37266

Root

Cause

The vulnerability is a prototype pollution flaw found in the extend function within babel.js of the stealjs/steal package, version 2.2.4 [1][2]. The issue occurs through the key variable in that function, allowing an attacker to pollute the base object's prototype [1].

Exploitation

An attacker can exploit this by providing a crafted object that includes properties like __proto__ or constructor.prototype as the key in the extend function. The function does not properly validate or sanitize the key before assigning it, leading to the pollution of Object.prototype [2]. This exploitation requires the attacker to control the input passed to the vulnerable extend function.

Impact

Successful exploitation allows an attacker to add or modify properties on Object.prototype, affecting all objects in the application. This can lead to unexpected behavior, security bypasses, or further attacks such as denial of service or privilege escalation, depending on how the affected application uses the polluted properties.

Mitigation

As of the publication date, a fix has not been provided in the steal 2.2.4 release [1]. Users should monitor the steal repository for an update, apply a workaround if possible, or avoid using the vulnerable extend function with untrusted input.