Fix CVE–2022–37601

[debricked]

CVE–2022–37601

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

GitHub

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    loader-utils/lib/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    Prototype pollution in webpack loader-utils · CVE-2022-37601 · GitHub Advisory Database · GitHub
    NVD - CVE-2022-37601
    loader-utils/lib/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    Release v2.0.3 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    Release v1.4.1 · webpack/loader-utils · GitHub
    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    THIRD PARTY
    On Measuring Vulnerable JavaScript Functions in the Wild | Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security
    [invalid] Prototype pollution found in dom.js · Issue #436 · xmldom/xmldom · GitHub
    THIRD PARTY
    [SECURITY] [DLA 3258-1] node-loader-utils security update
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit · webpack/loader-utils@f4e48a2 · GitHub
    fix: security problem (#220) · webpack/loader-utils@4504e34 · GitHub
    fix(security): prototype polution exploit (#217) · webpack/loader-utils@a93cf6f · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE