CVE-2020-28502: 
JavaScript vulnerability analysis and mitigation

CVE-2020-28502 is an arbitrary code injection vulnerability affecting the xmlhttprequest package before version 1.7.0 and all versions of xmlhttprequest-ssl. The vulnerability was discovered and disclosed on March 5, 2021, impacting Node.js applications using these packages (NVD, Snyk).

The vulnerability occurs when requests are sent synchronously (async=False on xhr.open), where malicious user input flowing into xhr.send could result in arbitrary code being injected and executed. The vulnerability has a CVSS v3.1 base score of 8.1 (High), with attack vector being Network, attack complexity High, requiring no privileges or user interaction (Snyk).

When successfully exploited, this vulnerability can lead to a total loss of confidentiality, integrity, and availability of the affected system. The attacker could potentially execute arbitrary code, leading to complete system compromise. The high severity rating indicates serious potential consequences including unauthorized access to sensitive data and system manipulation (Snyk).

The vulnerability has a proof-of-concept exploit available. The exploit involves sending a malicious payload through a synchronous XMLHttpRequest that can result in arbitrary code execution. A sample proof of concept demonstrates the ability to write files to the system through malicious input injection (Snyk).

The recommended mitigation is to upgrade xmlhttprequest to version 1.7.0 or higher, and xmlhttprequest-ssl to version 1.6.2 or higher. These versions contain the necessary security fixes to address the vulnerability (Snyk, Snyk SSL).