Vulnerability Directory | CVE-2022-37602 | AngularJS

Overview

Grunt-karma is a Grunt plugin that integrates the Karma test runner into Grunt build processes, allowing JavaScript unit tests to run as part of automated tasks.

A Prototype Pollution vulnerability (CVE-2022-37602) has been identified in grunt-karma, which allows a malicious actor to modify an object's prototype, potentially leading to unexpected behavior or security issues.

Per OWASP: Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's JavaScript objects and properties, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

This affects all versions of grunt-karma greater than or equal to 0.10.0.

‍

Details

Module Info

Product: Grunt Karma
Affected packages: grunt-karma
Affected versions: >=0.10.0
GitHub repository: https://github.com/karma-runner/grunt-karma
Published packages: https://www.npmjs.com/package/grunt-karma
Package manager: npm
Fixed in: NES for AngularJS Essentials Plus Grunt Karma v4.0.3

‍

Vulnerability Info

This Critical-severity vulnerability is found in all grunt-karma packages greater than or equal to 0.10.0.

grunt-karma allows users to specify preprocessors in a gruntfile.js. Preprocessors allow you to do some work with your files before they get served to the browser.

The grunt-karma task reads the preprocessor configuration object listed in your gruntfile.js, creates an object with the literal notation, and assigns values to the preprocessors object without sanitizing the keys:

var preprocessors = {}
// ...
  preprocessors[key] = value

This theoretically allows overriding the object's special __proto__ property, potentially changing its behavior and causing unexpected failures or bypassing checks.

‍