Prototype pollution in xmldom - CVE-2022-37616

Vulnerability identifier: #VU77487

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37616

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists in the function copy in dom.js in the xmldom package for Node.js via the p variable. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

xmldom
Cloud Pak for Security (CP4S)
Ubuntu
node-xmldom (Ubuntu package)
IBM Cloud Pak for Watson AIOps
App Connect Enterprise Certified Container
Automation Assets in IBM Cloud Pak for Integration (CP4I)

Install update from vendor's website.

xmldom - update to 0.8.3
Cloud Pak for Security (CP4S) - update to 1.10.7.0
node-xmldom (Ubuntu package) - addressed in versions 0.1.27+ds-1+deb10u2build0.20.04.1, 0.7.5-1ubuntu0.22.04.1, 0.7.5-1ubuntu0.22.10.1
IBM Cloud Pak for Watson AIOps - update to 3.6.0
App Connect Enterprise Certified Container - addressed in versions 5.0.2, 6.1.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-4

• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
• https://github.com/xmldom/xmldom/issues/436
• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
• https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
• https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
• https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
• https://dl.acm.org/doi/abs/10.1145/3488932.3497769
• http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
• https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
• https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560

• Prototype pollution in IBM App Connect Enterprise Certified Container
• Ubuntu update for node-xmldom
• Prototype pollution in Automation Assets in IBM Cloud Pak for Integration (CP4I)
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)