Critical Object Manipulation Vulnerability in xml2js Package
Summary
CVE-2023-0842: xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. Affects node-xml2js versions < 0.2.8-1.1+deb11u1. Fixed in 0.2.8-1.1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xml2js package is a widely used Node.js library that facilitates the conversion of XML data into JavaScript objects. It is known for its ease of use and flexibility, allowing developers to handle XML data efficiently in their applications. However, the package has a significant vulnerability that arises from improper validation of incoming JSON keys, specifically allowing external attackers to manipulate object properties.
Vulnerability Detail
The vulnerability, identified as CVE-2023-0842, allows an external attacker to edit or add new properties to an object due to the lack of proper validation for incoming JSON keys. This flaw enables the modification of the proto property, which can lead to prototype pollution. The ramifications of this vulnerability are serious, as it can potentially allow attackers to execute arbitrary code, escalate privileges, or disrupt application functionality. The vulnerability affects multiple versions of the xml2js package across different Debian ecosystems.
How To Fix
Minimum fixed version
0.2.8-1.1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-xml2jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to sanitize incoming JSON keys and prevent manipulation of the proto property. This can be done by checking the keys against a whitelist or using libraries that provide secure object manipulation methods.
Conclusion
The xml2js package has a critical vulnerability (CVE-2023-0842) that allows external manipulation of object properties due to improper validation of JSON keys. It is crucial to update the package to a secure version to mitigate the risks associated with this vulnerability. Additionally, implementing input validation can serve as a temporary workaround.
See every vulnerability recorded for node-xml2js →
FAQ
CVE-2023-0842 is a vulnerability in the xml2js package that allows external attackers to manipulate object properties due to improper validation of JSON keys.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include arbitrary code execution, privilege escalation, and disruption of application functionality due to prototype pollution.
The CVSS score for CVE-2023-0842 is 5.3, indicating a moderate severity level.
If you find your application is vulnerable, report it to your development team immediately and follow the steps outlined in the 'how to fix' section to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for node-xml2js.
