Is CVE-2022-25645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25645 being exploited in the wild.

How severe is CVE-2022-25645?

Low severity, with a CVSS score of 3.1, published 3 May 2022.

Which products and versions are affected?

org.webjars.npm:dset (Maven) ECOSYSTEM:introduced=0,fixed=3.1.2; dset (npm) SEMVER:introduced=0,fixed=3.1.2.

Is there a fix for CVE-2022-25645?

Yes. org.webjars.npm:dset (Maven): upgrade to 3.1.2 or later; dset (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25645 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25645?

Check whether you run org.webjars.npm:dset (Maven) or dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25645: lukeed dset prototype pollution in merge mode

CVE-2022-25645 · Severity: low · CVSS 3.1 · Published 2022-05-03

dset is a small utility used by developers to safely write values deep into JavaScript objects. A vulnerability in its merge mode allows an attacker to bypass security checks and modify the base structure of all objects in the application. This could lead to application crashes, unauthorized data modification, or potentially full control over the affected system.

Technologies: dset (npm). Vendors: Maven, npm.

Quick answers

Is CVE-2022-25645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25645 being exploited in the wild.
How severe is CVE-2022-25645?: Low severity, with a CVSS score of 3.1, published 3 May 2022.
Which products and versions are affected?: org.webjars.npm:dset (Maven) ECOSYSTEM:introduced=0,fixed=3.1.2; dset (npm) SEMVER:introduced=0,fixed=3.1.2.
Is there a fix for CVE-2022-25645?: Yes. org.webjars.npm:dset (Maven): upgrade to 3.1.2 or later; dset (npm): upgrade to 3.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25645 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25645?: Check whether you run org.webjars.npm:dset (Maven) or dset (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.webjars.npm:dset (Maven): upgrade to 3.1.2 or later

# set org.webjars.npm:dset to 3.1.2 in your pom.xml or build.gradle

dset (npm): upgrade to 3.1.2 or later
```
npm install dset@3.1.2
```

Technical details

The dset library is vulnerable to prototype pollution when using the 'dset/merge' functionality. The root cause is an insufficient validation check that only inspects the top-level path for sensitive keys like '__proto__', 'constructor', or 'prototype'. An attacker can bypass this check by crafting a malicious object (e.g., using JSON.parse to include specific keys) that is then recursively merged into a target object. If successful, the attacker can pollute the global Object.prototype, which may lead to Denial of Service (DoS), property injection, or Remote Code Execution (RCE) depending on the application's environment. The issue is fixed in version 3.1.2.

Affected products

lukeed dset < 3.1.2

Identifiers

CVE-2022-25645
GHSA-23wx-cgxq-vpwx

Timeline

2022-01-06: disclosed
2022-03-23: advisory: Snyk advisory published
2022-05-01: advisory: NVD published CVE-2022-25645
2022-05-03: advisory: GitHub GHSA published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.