cve/2022/CVE-2022-25878.md

CVE-2022-25878

Description

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507
• https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/MaySoMusician/geidai-ikoi
• https://github.com/dellalibera/dellalibera
• https://github.com/seal-community/patches