Quick answers
- Is CVE-2022-37265 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-37265 being exploited in the wild.
- How severe is CVE-2022-37265?
- Low severity, with a CVSS score of 3.1, published 21 September 2022.
- Which products and versions are affected?
- steal (npm) SEMVER:introduced=0,last_affected=2.3.0.
- Is there a fix for CVE-2022-37265?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2022-37265 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-37265?
- Check whether you run steal (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in stealjs steal version 2.3.0 and earlier, specifically in the babel.js extension's handling of the alias variable. The vulnerability exists in babel.js at lines 4216 and 4569, where unsanitized user input is used to set object properties without proper validation. An attacker with network access can exploit this via the babel configuration to pollute Object.prototype by injecting malicious alias entries, affecting all objects created after the attack. This is a network-reachable vulnerability requiring no authentication or user interaction, allowing arbitrary property injection that can lead to application compromise or denial of service.
Affected products
- stealjs steal 0 through 2.3.0
Identifiers
- CVE-2022-37265
- GHSA-wc4x-qmr2-rj8h
Timeline
- 2022-09-21: disclosed
- 2022-09-20: advisory: NVD published advisory