CVE-2022-37598: UglifyJS Prototype Pollution Vulnerability

CVE-2022-37598 Overview

CVE-2022-37598 is a prototype pollution vulnerability affecting the DEFNODE function in ast.js within mishoo UglifyJS version 3.13.2. The vulnerability exists in the handling of the name variable within the AST (Abstract Syntax Tree) processing code. Prototype pollution is a JavaScript-specific vulnerability that allows attackers to modify the prototype of base objects, potentially leading to remote code execution, denial of service, or property injection attacks.

It is important to note that the vendor considers this an invalid report. Despite this dispute, the CVE remains published and organizations should evaluate their own risk exposure.

Critical Impact

This prototype pollution vulnerability could allow attackers to inject malicious properties into JavaScript object prototypes, potentially leading to remote code execution or application compromise in Node.js environments using UglifyJS for JavaScript minification.

Affected Products

• UglifyJS 3.13.2
• Node.js applications using vulnerable UglifyJS versions
• Build pipelines and CI/CD systems incorporating UglifyJS for JavaScript minification

Discovery Timeline

• 2022-10-20 - CVE-2022-37598 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-37598

Vulnerability Analysis

The prototype pollution vulnerability resides in the DEFNODE function within the ast.js file of UglifyJS. Prototype pollution occurs when user-controllable input is used to modify the prototype chain of JavaScript objects. In this case, the name variable in the DEFNODE function is susceptible to manipulation, potentially allowing an attacker to pollute the Object.prototype or other base object prototypes.

When exploited, prototype pollution can have cascading effects throughout the application. Properties added to Object.prototype become inherited by all objects in the JavaScript runtime, which can lead to unexpected behavior, security bypasses, or in severe cases, remote code execution when combined with other application logic.

The vulnerability is categorized under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), which describes the class of vulnerabilities where applications fail to properly sanitize inputs used in prototype modification operations.

Root Cause

The root cause stems from improper input validation in the DEFNODE function within ast.js. The function does not adequately sanitize or validate the name parameter before using it in operations that could affect object prototypes. This allows specially crafted input containing properties like __proto__, constructor, or prototype to modify the prototype chain of JavaScript objects.

The vulnerable code paths can be found at lines 46 and 79 of the ast.js file in the affected version.

Attack Vector

The attack vector is network-based and can be exploited remotely without authentication. An attacker could supply malicious JavaScript code or configuration to an application that uses UglifyJS for minification. If the vulnerable DEFNODE function processes attacker-controlled input without proper sanitization, the prototype pollution occurs.

Typical attack scenarios include:

1. Supplying malicious JavaScript files to build systems that use UglifyJS
2. Exploiting web applications that perform server-side JavaScript minification on user-provided content
3. Targeting CI/CD pipelines where UglifyJS processes untrusted code

The vulnerability mechanism works by passing specially crafted values through the name variable that reference prototype properties. When these values are processed, they can inject or modify properties on base object prototypes, affecting all objects that inherit from them.

For detailed technical analysis, refer to GitHub Issue #5699 and the vendor's response in Issue #5721.

Detection Methods for CVE-2022-37598

Indicators of Compromise

• Unexpected properties appearing on JavaScript objects that were not explicitly defined
• Application behavior anomalies related to object property inheritance
• Log entries showing unusual AST node names containing __proto__, constructor, or prototype
• Build process failures or unexpected minification output from UglifyJS

Detection Strategies

• Implement dependency scanning to identify UglifyJS version 3.13.2 in your Node.js projects using tools like npm audit or Snyk
• Monitor build pipelines for unusual behavior during JavaScript minification phases
• Deploy runtime application self-protection (RASP) solutions capable of detecting prototype pollution attempts
• Use static analysis tools that can identify prototype pollution vulnerabilities in JavaScript code

Monitoring Recommendations

• Enable verbose logging in build systems that utilize UglifyJS to capture processing details
• Implement integrity checks on minified JavaScript output to detect unexpected modifications
• Monitor for new CVEs and security advisories related to UglifyJS and its dependencies
• Set up alerts for dependency version changes in your package.json and package-lock.json files

How to Mitigate CVE-2022-37598

Immediate Actions Required

• Audit your Node.js projects to identify if UglifyJS version 3.13.2 is in use
• Consider using alternative JavaScript minification tools such as Terser, which is actively maintained
• Implement input validation if processing untrusted JavaScript code with UglifyJS
• Review the vendor's position in GitHub Issue #5721 to understand their assessment
• Apply the principle of least privilege to build processes that utilize UglifyJS

Patch Information

The vendor has disputed this vulnerability report, considering it invalid. As such, there is no official patch released specifically for this issue. Organizations should monitor the UglifyJS GitHub repository for any updates or security advisories.

Given the disputed status, organizations may consider:

• Migrating to alternative minification tools like Terser (a maintained fork of UglifyJS)
• Implementing application-level protections against prototype pollution
• Freezing object prototypes in critical applications using Object.freeze(Object.prototype)

Workarounds

• Freeze JavaScript object prototypes at application startup using Object.freeze(Object.prototype) to prevent prototype pollution
• Implement strict input validation for any JavaScript code processed by UglifyJS
• Use object creation patterns that don't inherit from Object.prototype, such as Object.create(null)
• Isolate UglifyJS processing in sandboxed environments or containers to limit potential impact
• Consider migrating to Terser, which is a maintained fork of UglifyJS with active security support

# Check for vulnerable UglifyJS version in your project
npm list uglify-js

# Alternative: Use Terser instead of UglifyJS
npm uninstall uglify-js
npm install terser

# Freeze Object.prototype in Node.js applications (add to entry point)
# Object.freeze(Object.prototype);