CVE-2022-37616

Vulnerability

Description

The vulnerability resides in the copy function within dom.js of the xmldom package (published as @xmldom/xmldom) for Node.js. It allows prototype pollution through the p variable, meaning an attacker can modify the prototype of base objects [1][4]. The vendor has disputed the validity of this report, but some third parties consider it a valid prototype pollution issue because the target object is polluted even if global objects are not directly affected [2].

Exploitation

An attacker can supply a specially crafted XML document that, when parsed by xmldom, triggers the copy function to pollute the Object prototype. No authentication is required if the application parses untrusted XML input [2][4]. The attack surface includes any Node.js application that uses xmldom to parse XML from external sources.

Impact

Successful exploitation could lead to property injection, potentially affecting application logic, security controls, or enabling further attacks such as denial of service or privilege escalation [2]. The exact impact depends on how the polluted properties are used by the application.

Mitigation

The vendor has marked the report as invalid, but the CVE remains assigned. Users are advised to upgrade to version 0.8.3 or later, which includes fixes for related issues [1][4]. As of the latest releases, the package has addressed other security concerns, and users should ensure they are on a supported version.