Executive brief
Json Pattern Validator (jpv) is a Node.js library used to validate JSON data against custom validation patterns. An attacker can bypass validation rules by injecting crafted JSON payloads that overwrite internal object attributes, allowing invalid data to pass validation checks that should have been rejected.
Technical details
The vulnerability exists in the compareCommon() function within jpv versions before 2.1.1. The vulnerability class is an authentication/validation bypass (CWE-287) stemming from insufficient input sanitization. An attacker can craft a malicious JSON payload containing conflicting property names (e.g., 'constructor': {'name':'Array'}) that overwrites internal JavaScript object attributes used for type detection. This corrupts the type-checking logic in the validate() function, allowing crafted payloads to bypass intended validation rules. The attack requires no authentication or special privileges and is triggered by sending a crafted JSON payload to an application using the vulnerable jpv library. The fix is available in jpv version 2.1.1 and later.
Affected products
- jpv Json Pattern Validator before 2.1.1
Timeline
- 2019-12-04: disclosed
- 2019: patched: version 2.1.1 released