Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-21213

CVE-2022-21213: Prototype Pollution in mout

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-21213
GHSA ID
GHSA-vvv8-xw5f-3f88
EPSS Score
0.78622%
CWE
CWE-1321
Published
6/18/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
moutnpm<= 1.2.31.2.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the 'set' function's handling of property keys. The commit diff shows critical changes in src/object/set.js where the 'prop' parameter is explicitly converted to a string and checked for prototype pollution patterns. The added test case in tests/spec/object/spec-set.js demonstrates protection against array-based prototype pollution vectors. While vulnerability descriptions mention deepFillIn/deepMixIn, the actual fix and PoC target the 'set' function, indicating it was the primary vulnerable entry point. The previous CVE-2020-7792 addressed deepMixIn/deepFillIn, making this a new vulnerability in a different function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*is *****ts *ll v*rsions o* p**k*** mout. T** ***p*illIn *un*tion **n ** us** to '*ill missin* prop*rti*s r**ursiv*ly', w*il* t** ***pMixIn mix*s o*j**ts into t** t*r**t o*j**t, r**ursiv*ly mixin* *xistin* **il* o*j**ts *s w*ll. In *ot* **s*s, t** k

Reasoning

T** vuln*r**ility st*ms *rom t** 's*t' *un*tion's **n*lin* o* prop*rty k*ys. T** *ommit *i** s*ows *riti**l ***n**s in sr*/o*j**t/s*t.js w**r* t** 'prop' p*r*m*t*r is *xpli*itly *onv*rt** to * strin* *n* ****k** *or prototyp* pollution p*tt*rns. T**