PT-2022-24020 · Mishoo+1 · Uglify-Js+1

Ciarancolgan · Published 2022-10-20 · Updated 2024-08-03 · CVE-2022-37598

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mishoo UglifyJS version 3.13.2

Description The issue is related to a prototype pollution vulnerability in the function DEFNODE in ast.js, specifically via the name variable. This vulnerability is present in mishoo UglifyJS. The vendor has considered this report as invalid.

Recommendations For mishoo UglifyJS version 3.13.2, consider restricting access to the DEFNODE function in ast.js to minimize the risk of exploitation. As a temporary workaround, consider disabling the DEFNODE function until a patch is available or further guidance is provided by the vendor. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

AZL-44541

CVE-2022-37598

Affected Products

Debian

Uglify-Js

References · 15

• 🔥 https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79 · Exploit
• 🔥 https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46 · Exploit
• https://ubuntu.com/security/CVE-2022-37598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37598 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37598 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44541 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37598 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37598 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37598 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-37598 · Security Note
• https://github.com/mishoo/UglifyJS/issues/5721#issuecomment-1292849604 · Note
• https://github.com/mishoo/UglifyJS/issues/5699 · Note
• https://t.me/cvenotify/88757 · Telegram Post
• https://t.me/cvenotify/38448 · Telegram Post
• https://t.me/cibsecurity/51862 · Telegram Post