CVE-2022-22912
📋 TL;DR
CVE-2022-22912 is a prototype pollution vulnerability in the Plist.js library's .parse() function that allows attackers to modify object prototypes. This can lead to denial of service or potentially remote code execution. Any application using vulnerable versions of Plist.js for parsing property list files is affected.
💻 Affected Systems
- plist.js library
- Applications using plist.js for property list parsing
📦 What is this software?
Plist by Plist Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Denial of service through application crashes or instability
If Mitigated
Limited impact with proper input validation and sandboxing
🎯 Exploit Status
Exploitation requires feeding malicious plist content to the vulnerable .parse() function
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.4
Vendor Advisory: https://github.com/TooTallNate/plist.js/issues/114
Restart Required: Yes
Instructions:
1. Update plist.js dependency to version 3.0.4 or later
2. Run 'npm update plist' or 'yarn upgrade plist'
3. Restart affected applications
4. Test functionality with updated version
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation of plist file inputs before parsing
Sandbox parsing operations
allRun plist parsing in isolated containers or sandboxed environments
🧯 If You Can't Patch
- Implement strict network controls to prevent untrusted plist files from reaching vulnerable systems
- Deploy web application firewalls with plist parsing protection rules
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/plist/package.json for version numberCheck Version:
npm list plist | grep plist OR cat node_modules/plist/package.json | grep versionVerify Fix Applied:
Verify plist version is 3.0.4 or higher in package.json and test parsing functionality📡 Detection & Monitoring
Log Indicators:
- Application crashes during plist parsing
- Unusual memory consumption spikes
- Stack traces containing plist.js functions
Network Indicators:
- Unexpected plist file uploads to web applications
- Suspicious file transfers to parsing endpoints
SIEM Query:
source="application.log" AND ("plist" OR ".parse()") AND ("crash" OR "error" OR "exception")