xml2js 0.4.23 - Prototype Pollution

Root

Cause

The xml2js library, up to version 0.4.23, is vulnerable to Prototype Pollution. The parser fails to validate incoming JSON keys during XML-to-JSON conversion, allowing an attacker to inject a __proto__ property into the resulting object [1][2][4]. This is a classic JavaScript prototype pollution flaw: by setting __proto__ on a parsed object, an attacker can add or overwrite properties on all objects of that type, because the polluted property propagates through the prototype chain [4].

Exploitation

An external attacker can craft a malicious XML payload that, when parsed by xml2js, produces a JSON object containing a __proto__ key. Since the library does not sanitize or prevent the assignment of __proto__, the attacker effectively pollutes the base Object.prototype [2][4]. No authentication or special privileges are required; the vulnerability is triggered simply by parsing attacker-controlled XML input.

Impact

Successful exploitation allows the attacker to edit or add arbitrary properties to any JavaScript object in the application's runtime. This can lead to a variety of severe security consequences, including denial of service, arbitrary code execution, or bypassing security checks [4].

Mitigation

As of the publication date (April 2023), no official patch had been released [4]. The fixed version should use Object.create(null) to create parsed objects without a prototype, as suggested in a related pull request [3]. Users are advised to update to a patched version once available, or apply workarounds such as sanitizing XML input or using a different XML parser.