Executive brief
node-rules is a popular JavaScript library used to define and execute business rules in applications. A code injection vulnerability in the fromJSON() function allows attackers to execute arbitrary code without authentication, potentially compromising any application using this library to process untrusted rule inputs.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the fromJSON() function of node-rules versions 3.0.0 through 4.x. The function accepts user-controlled rule objects without sanitization, allowing attackers to inject arbitrary JavaScript code via prototype pollution attacks. The injection point is in lines 152-153 where the condition and consequence fields are processed. No authentication or user interaction is required; an attacker can call fromJSON() with malicious rule objects to execute arbitrary code in the context of the application. A patch was released in version 5.0.0.
Affected products
- node-rules node-rules 3.0.0 through 4.x prior to 5.0.0
Timeline
- 2020-03-16: disclosed: Vulnerability disclosed by Snyk Security team
- 2020: patched: Fix released in version 5.0.0
- 2021-12-10: advisory: GitHub Security Advisory GHSA-f78f-353m-cf4j published