CVE-2022-37621

Vulnerability

Description CVE-2022-37621 is a prototype pollution vulnerability in the resolveShims function of the resolve-shims.js file in the browserify-shim package (version 3.8.15). The flaw occurs when the fullPath variable is used to set properties on an object without proper sanitization, allowing an attacker to inject properties into the global Object.prototype [1][2]. This is a classic prototype pollution pattern where user-controlled input can modify the prototype chain of all objects.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious fullPath value that contains special keys like __proto__ or constructor.prototype. When the resolveShims function processes this input, it pollutes the prototype of all objects in the application [3][4]. The attack requires the ability to influence the fullPath variable, which may be achieved through a malicious package.json or shim configuration file. No authentication is needed if the attacker can supply such a file to the build process.

Impact

Successful exploitation allows an attacker to pollute Object.prototype, leading to potential property injection across the entire application. This can result in denial of service, unexpected behavior, or in some cases, arbitrary code execution if the polluted properties are used in security-sensitive operations [3]. The impact is amplified in server-side or build-time contexts where the polluted prototype affects all subsequent object operations.

Mitigation

The vulnerability has been patched in a commit to the browserify-shim repository [2]. Users should update to a version that includes the fix (e.g., after commit 97855e6). There is no evidence that this CVE is listed in CISA's Known Exploited Vulnerabilities catalog. As a workaround, users can avoid processing untrusted shim configurations or sanitize input before passing it to resolveShims.