CVE-2022-23631: Prototype Pollution leading to Remote Code Execution in superjson
Summary
CVE-2022-23631: Prototype Pollution leading to Remote Code Execution in superjson. Affects superjson versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
superjson is an npm package that provides a secure way to serialize and deserialize JSON data. It is commonly used in web applications, including frameworks like Blitz.js. The vulnerability in superjson allows attackers to exploit prototype pollution, which can lead to remote code execution on servers that use superjson for request processing. This vulnerability poses a critical risk as it enables attackers to gain full control over the server, potentially compromising data and launching further attacks.
Vulnerability Detail
The vulnerability arises from a prototype pollution issue in superjson. By manipulating the input data, an attacker can inject malicious code that gets executed on the server. This can be done without authentication or prior knowledge, as long as the server implements at least one endpoint that uses superjson. For example, in the case of Blitz.js, an RPC call would be sufficient. The impact of this vulnerability is severe, as it allows attackers to steal and manipulate data, as well as launch attacks on other systems. The vulnerability has been assigned a CVSS score of 9.0, indicating its high severity.
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
npm install superjson@1.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in superjson poses a critical risk to servers using this package, especially in conjunction with frameworks like Blitz.js. Upgrading to the patched versions of superjson and Blitz.js is crucial to mitigate the risk of remote code execution and potential data theft. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for superjson →
FAQ
The vulnerability allows attackers to execute arbitrary code on servers using superjson, including Blitz.js servers. This grants them full control over the server, enabling data theft, manipulation, and potential attacks on other systems.
To fix the vulnerability, upgrade to the patched versions of superjson (1.8.1) and Blitz.js (0.45.3). If immediate upgrade to Blitz.js 0.45.3 is not possible, upgrade only superjson to version 1.8.1 using yarn resolutions or a similar package management tool.
No, there are no known workarounds for this vulnerability. Upgrading to the patched versions is the recommended solution.
For more information, you can open an issue in the superjson GitHub repository or email the developers at b@bayer.ws.
Versions of superjson prior to 1.8.1 and versions of Blitz.js prior to 0.45.3 are affected by this vulnerability.
