Executive brief
json-ptr is a JavaScript library for manipulating JSON pointer paths. The library contains a prototype pollution vulnerability in its set operation that allows arbitrary code execution when the force flag is enabled. An attacker can exploit this to inject and execute malicious code in applications using the library.
Technical details
The vulnerability is a prototype pollution issue in json-ptr before version 2.1.0, occurring in the set operation when the force flag is set to true. The function recursively sets properties in the target object without properly sanitizing the key being set, allowing an attacker to inject escape sequences and break out of the intended property assignment context. The vulnerability can be triggered via specially crafted JSON pointer paths containing quote characters (e.g., '/aaa\'\]\)\)') that are not properly escaped, enabling arbitrary code execution. The fix involves properly escaping single quotes and backslashes in the pointer path using .replace() calls. No authentication is required, and the attack vector is network-accessible if the library processes untrusted input.
Affected products
- npm json-ptr before 2.1.0
Timeline
- 2020-11-10: disclosed: NVD publication date
- 2021-05-10: advisory: GHSA advisory published
- 2021: patched: Fixed in version 2.1.0