CVE-2022-37623

Vulnerability

Overview

The vulnerability resides in the resolveShims function within resolve-shims.js of the browserify-shim package (version 3.8.15). The function fails to properly sanitize the shimPath variable, allowing an attacker to inject properties into the global Object.prototype through a technique known as prototype pollution [2][4].

Exploitation

An attacker can exploit this flaw by crafting a malicious shimPath value that includes prototype properties like __proto__ or constructor.prototype. The vulnerable function processes this path without validation, enabling the pollution of the base object prototype. No authentication is required if the attacker can supply input to the shimPath parameter, which may occur when processing untrusted configuration files or user-supplied data [1][2].

Impact

Once the prototype is polluted, all objects in the application inherit the attacker-controlled properties. This can lead to unexpected behavior, denial of service, or further exploitation such as arbitrary code execution if the polluted properties affect security-sensitive operations. The impact is especially significant in browserify bundles that process untrusted configuration [1].

Mitigation

The project maintainers have addressed this vulnerability in commit 97855e622b6dcd117c77e6583701962ff45e7338, which prevents prototype manipulation by properly sanitizing the shimPath variable [3]. Users should update to a patched version, or if unavailable, manually apply the fix or avoid processing untrusted input with vulnerable versions.