Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-37611

CVE-2022-37611:
tschaub gh-pages vulnerable to prototype pollution

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-37611
GHSA ID
GHSA-8mmm-9v2q-x3f9
EPSS Score
0.30985%
CWE
CWE-1321
Published
10/12/2022
Updated
4/22/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
gh-pagesnpm< 5.0.05.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using a regular object ({}) to track directories in uniqueDirs function. When processing file paths, the 'partial' variable (constructed from path segments) is used as a key without sanitization. This allows prototype pollution through specially crafted file paths. The fix in commit #452 replaced the object with a Set, which confirms the vulnerability was in this object-based implementation. The references to lines 11 and 16 in util.js point directly to this path processing logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Prototyp* pollution vuln*r**ility in ts***u* **-p***s vi* t** p*rti*l v*ri**l* in util.js.

Reasoning

T** vuln*r**ility st*ms *rom usin* * r**ul*r o*j**t ({}) to tr**k *ir**tori*s in `uniqu**irs` *un*tion. W**n pro**ssin* *il* p*t*s, t** 'p*rti*l' v*ri**l* (*onstru*t** *rom p*t* s**m*nts) is us** *s * k*y wit*out s*nitiz*tion. T*is *llows prototyp* p