Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-x3cc-x39p-42qx: fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

ghsa
#vulnerability#nodejs#js#git#intel

Package

npm fast-xml-parser (npm)

Affected versions

< 4.1.2

Patched versions

4.1.2

Description

Impact

As a part of this vulnerability, user was able to se code using proto as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require(“fast-xml-parser”);

let XMLdata = “<__proto__><polluted>hacked</polluted></__proto__>”

const parser = new XMLParser(); let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

References

  • GHSA-x3cc-x39p-42qx
  • NaturalIntelligence/fast-xml-parser@2b032a4
  • https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

amitguptagwl published to NaturalIntelligence/fast-xml-parser

Jun 11, 2023

Published to the GitHub Advisory Database

Jun 13, 2023

Reviewed

Jun 13, 2023

Last updated

Jun 13, 2023

Related news

CVE-2023-26920: report.md

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.