CVE-2022-37617

Vulnerability

Overview

CVE-2022-37617 is a prototype pollution vulnerability found in the resolveShims function within resolve-shims.js of the browserify-shim npm package (version 3.8.15) [1][2][3][4]. The vulnerability occurs when processing user-controlled data through the k variable, which is used to set properties on objects without proper input validation, allowing an attacker to pollute the global Object.prototype [2][4].

Attack

Vector and Exploitation

An attacker can exploit this by crafting a malicious k value — typically a string like __proto__ or constructor.prototype — that, when processed by the resolveShims function, results in properties being set on the prototype chain [2][4]. The attack does not require authentication beyond the ability to supply configuration data processed by browserify-shim, which is commonly used as a Browserify transform to make non-CommonJS modules bundleable [1].

Impact

Successful exploitation allows the attacker to inject arbitrary properties into Object.prototype, affecting all objects in the runtime. This prototype pollution can lead to denial of service (via property collisions or runtime errors) or facilitate further attacks, such as bypassing security checks or altering application behavior [3][4].

Mitigation

The issue was addressed in a commit (97855e6) that prevents prototype manipulation by validating property assignments before applying them [2]. Users should update to a patched version (e.g., 3.8.16 or later) or apply the fix manually. There is no evidence of active exploitation in the wild, but the CVE is publicly known, and the repository has been notified [4].