Business Automation is affected by a prototype pollution in async. The original advisory for Async was published 2022-04-07.
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. — GCVE
IBM’s bulletin lists Business Automation Workflow 21.0.2 and 21.0.3, traditional and containers, at CVSS 7.8.
The fix is APAR JR64868, the interim fixes 21.0.3-IF010 and 21.0.2-IF012, or an upgrade to 22.0.1.
The GitHub advisory for CVE-2021-43138 puts the fix in async 2.6.4 and 3.2.2, and the 2.6.4 changelog sums it up as “Fix potential prototype pollution exploit”.
Snyk traces it to an improper check in createObjectIterator.
The PoC needs nothing more than JSON.parse('{"__proto__": {"isAdmin": true}}') fed to async.mapValues() to hand the result an inherited isAdmin.
“Remote code execution” in the title, AV:L and user interaction in the vector, so someone still has to open the crafted file.