Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36059

CVE-2022-36059:
matrix-js-sdk Prototype Pollution vulnerability

7.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36059
GHSA ID
GHSA-rfv9-x7hh-xc32
EPSS Score
0.74215%
CWE
CWE-1321
Published
3/28/2023
Updated
3/28/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
matrix-js-sdknpm< 19.4.019.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

Prototype pollution vulnerabilities typically occur in functions that: 1) Process untrusted JSON input 2) Use recursive object merging 3) Assign properties using user-controlled keys. The advisory specifically mentions event processing impacts, pointing to functions handling event content parsing (EventUtils) and sync processing (SyncApi). The deepCopy utility is a common pattern vulnerable to prototype pollution when not using safe merging. The high confidence for utils.deepCopy and EventUtils.parseEventContent comes from their direct role in processing event data, while SyncApi._processRoomEvents gets medium confidence due to its position in the sync workflow mentioned in workarounds.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *v*nts s*nt wit* sp**i*l strin*s in k*y pl***s **n t*mpor*rily *isrupt or imp*** t** m*trix-js-s*k *rom *un*tionin* prop*rly, pot*nti*lly imp**tin* t** *onsum*r's **ility to pro**ss **t* s***ly. Not* t**t t** m*trix-js-s*k **n *pp**r to **

Reasoning

Prototyp* pollution vuln*r**iliti*s typi**lly o**ur in *un*tions t**t: *) `Pro**ss` untrust** JSON input *) Us* r**ursiv* o*j**t m*r*in* *) *ssi*n prop*rti*s usin* us*r-*ontroll** k*ys. T** **visory sp**i*i**lly m*ntions *v*nt pro**ssin* imp**ts, poi