Prototype Pollution leading to Remote Code Execution in superjson

The impact of CVE-2022-23631 is severe. An attacker can gain complete control over the affected server by injecting malicious code through superjson input. This allows them to steal sensitive data, manipulate databases, install malware, and potentially pivot to other systems within the network. The vulnerability is particularly concerning because it requires no prior authentication, making it easily exploitable. In the context of Blitz.js, any RPC endpoint processing superjson input is vulnerable. This vulnerability shares similarities with other input validation flaws that have led to widespread compromise, highlighting the importance of secure data handling practices.

Applications built with Blitz.js that utilize superjson for data parsing are particularly at risk. Any Node.js application relying on superjson for processing external data, especially in API endpoints or RPC calls, is also vulnerable. Shared hosting environments where multiple applications share the same server instance are at increased risk due to the potential for cross-application exploitation.

• nodejs / server:

  npm list superjson

This command will list installed versions of superjson. Check if the version is less than 1.8.1. • nodejs / server:

  find / -name "superjson.js" -o -name "superjson.min.js" -print

Locate superjson files on the system to identify potential vulnerable deployments. • nodejs / server:

  grep -r 'superjson.parse' /path/to/your/app

Search for instances of superjson.parse within your application code, as this is a key function used in vulnerable scenarios.

1. 2022-02-09Disclosure

   disclosure

1. Reserviert2022-01-19
2. Veröffentlicht2022-02-09
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-23631 is to immediately upgrade to superjson version 1.8.1 or Blitz.js version 0.45.3. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all superjson input to prevent malicious code injection. Web application firewalls (WAFs) configured to detect and block suspicious input patterns can provide an additional layer of defense. Review and restrict access to RPC endpoints that utilize superjson to limit the potential attack surface. After upgrading, confirm the fix by attempting to submit a crafted superjson payload designed to trigger the vulnerability and verifying that it is now rejected.