Junglewise Threat Intelligence

CVE-2020-17479: jpv validation bypass in JSON parsing

CVE-2020-17479 · Severity: low · CVSS 3.1 · Published 2021-05-06

Vendors: npm.

Executive brief

jpv (Json Pattern Validator) is a JavaScript library used to validate JSON data against defined patterns. A validation bypass flaw allows attackers to submit malformed JSON data that should be rejected but instead passes validation, potentially allowing invalid or malicious data to be processed by applications relying on the library.

Technical details

jpv before version 2.2.2 contains an input validation bypass in its JSON pattern validation logic, specifically when processing array structures (CWE-20). The vulnerability allows specially crafted or corrupted JSON arrays to bypass validation checks that should reject them. The flaw is reachable over the network when the library is used in server-side applications, with no authentication required. An attacker can craft malicious JSON payloads to circumvent validation rules, potentially enabling injection attacks or data integrity violations. The fix is available in version 2.2.2 and later.

Affected products

  • jpv jpv before 2.2.2

Timeline

  • 2020-08-10: disclosed
  • 2020: patched: Version 2.2.2 released with fix
  • 2021-05-06: advisory: GHSA-vh6r-g38f-q3w8 published

References

Related threats