Is CVE-2022-25948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25948 being exploited in the wild.

How severe is CVE-2022-25948?

Low severity, with a CVSS score of 3.1, published 22 December 2022.

Which products and versions are affected?

liquidjs (npm) SEMVER:introduced=0,fixed=10.0.0.

Is there a fix for CVE-2022-25948?

Yes. liquidjs (npm): upgrade to 10.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25948 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-25948?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25948: LiquidJS prototype property information exposure

CVE-2022-25948 · Severity: low · CVSS 3.1 · Published 2022-12-22

LiquidJS is a popular template engine used to process Liquid templates in JavaScript applications. When misconfigured with ownPropertyOnly set to false, the engine exposes JavaScript prototype properties—including internal functions and built-in object methods—to template code. An attacker who can control template input could exploit this to access sensitive prototype information, potentially leading to information disclosure or further exploitation.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2022-25948 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25948 being exploited in the wild.
How severe is CVE-2022-25948?: Low severity, with a CVSS score of 3.1, published 22 December 2022.
Which products and versions are affected?: liquidjs (npm) SEMVER:introduced=0,fixed=10.0.0.
Is there a fix for CVE-2022-25948?: Yes. liquidjs (npm): upgrade to 10.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25948 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-25948?: Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.0.0 or later
```
npm install liquidjs@10.0.0
```

Technical details

The vulnerability is an information exposure flaw (CWE-200) affecting LiquidJS versions before 10.0.0. When the ownPropertyOnly parameter is set to false (the default prior to v10.0.0), template evaluation does not properly restrict access to prototype chain properties. An attacker providing malicious Liquid templates can access prototype getter functions and other inherited properties (such as .length or other Object prototype methods). This requires no authentication and can be triggered by any user input passed to the template engine. The fix was introduced in version 10.0.0 by changing the default value of ownPropertyOnly to true, and a partial workaround was available starting in version 9.34.0 via the ownPropertyOnly option.

Affected products

harttle liquidjs before 10.0.0

Identifiers

CVE-2022-25948
GHSA-45rm-2893-5f49

Timeline

2022-12-22: disclosed: Advisory published
2022-12-22: patched: Fix included in version 10.0.0; workaround available in 9.34.0+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.