CVE-2023-0842: Xml2js Prototype Pollution Vulnerability

CVE-2023-0842 Overview

CVE-2023-0842 is a Prototype Pollution vulnerability affecting the xml2js Node.js library version 0.4.23. This vulnerability allows an external attacker to edit or add new properties to an object due to improper validation of incoming JSON keys. Specifically, the application fails to prevent modification of the __proto__ property, enabling attackers to manipulate JavaScript object prototypes.

Critical Impact

Successful exploitation can lead to arbitrary property injection into application objects, potentially enabling denial of service, application logic manipulation, or in certain environments, remote code execution through polluted object prototypes.

Affected Products

• xml2js version 0.4.23
• xml2js_project xml2js (all versions prior to patched releases)
• Applications and services using vulnerable xml2js versions for XML-to-JSON parsing

Discovery Timeline

• 2023-04-05 - CVE-2023-0842 published to NVD
• 2025-09-24 - Last updated in NVD database

Technical Details for CVE-2023-0842

Vulnerability Analysis

This vulnerability belongs to the Prototype Pollution (CWE-1321) class of security flaws that affects JavaScript applications. The xml2js library provides functionality for parsing XML documents and converting them to JavaScript objects. During this conversion process, the library fails to adequately sanitize property names extracted from the XML input, allowing attackers to inject malicious keys such as __proto__, constructor, or prototype.

When an attacker crafts malicious XML containing specially named elements that correspond to JavaScript prototype properties, the parsing operation can modify the base Object.prototype. This pollution propagates to all objects in the JavaScript runtime that inherit from the modified prototype, potentially affecting application behavior across the entire codebase.

Root Cause

The root cause stems from insufficient input validation during the XML-to-JavaScript object transformation process. The xml2js library version 0.4.23 does not implement safeguards to filter or reject XML element names that correspond to sensitive JavaScript prototype properties. This oversight allows XML elements named __proto__ to be interpreted as prototype modification instructions rather than regular data properties.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can deliver malicious XML payloads to any application endpoint that processes XML input using the vulnerable xml2js library. The attack is particularly dangerous in server-side Node.js applications where:

1. User-controlled XML data is parsed by the application
2. The resulting JavaScript object is used in security-sensitive operations
3. Multiple requests share the same JavaScript runtime context

Prototype pollution attacks can chain with other application logic to achieve privilege escalation, bypass authentication checks, or manipulate application state. In worst-case scenarios where the polluted properties are used in command construction or code evaluation contexts, remote code execution may be possible.

Detection Methods for CVE-2023-0842

Indicators of Compromise

• XML payloads containing __proto__, constructor, or prototype as element names in incoming requests
• Unexpected properties appearing on JavaScript objects that weren't explicitly set by application code
• Application behavior anomalies following XML parsing operations
• Error logs indicating type mismatches or unexpected object properties

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XML payloads containing prototype pollution keywords
• Deploy application-level logging to capture and analyze XML parsing inputs for suspicious patterns
• Use runtime application self-protection (RASP) solutions to monitor object property assignments
• Conduct regular software composition analysis (SCA) scans to identify vulnerable xml2js versions in dependencies

Monitoring Recommendations

• Monitor application logs for unusual XML parsing errors or unexpected property access patterns
• Set up alerts for any runtime modifications to Object.prototype in production environments
• Track dependency versions through automated tooling and alert when vulnerable versions of xml2js are detected
• Implement network-level monitoring to identify abnormal XML payload sizes or structures

How to Mitigate CVE-2023-0842

Immediate Actions Required

• Upgrade xml2js to version 0.6.2 or later, which contains the security fix for this vulnerability
• Audit all applications and services in your environment that may use xml2js as a direct or transitive dependency
• Implement input validation to reject XML documents containing suspicious element names before parsing
• Consider using alternative XML parsing libraries with built-in prototype pollution protections

Patch Information

The xml2js maintainers have released version 0.6.2 which addresses this prototype pollution vulnerability. Organizations should update their package.json or package-lock.json files to specify the patched version. For detailed release information, see the GitHub Release Note 0.6.2. Additional details are available in the Fluid Attacks Security Advisory and the Debian LTS Announcement.

Workarounds

• Implement a pre-processing filter to sanitize XML element names before parsing with xml2js
• Use Object.freeze() on Object.prototype in Node.js applications to prevent prototype modifications (may cause compatibility issues)
• Configure xml2js with strict parsing options and validate output objects before use
• Deploy application-layer input validation to reject XML payloads containing __proto__, constructor, or prototype keywords

# Update xml2js to patched version
npm update xml2js@0.6.2

# Or explicitly set the version in package.json
npm install xml2js@0.6.2 --save

# Verify installed version
npm list xml2js