Quick answers
- Is CVE-2020-7766 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7766 being exploited in the wild.
- How severe is CVE-2020-7766?
- Low severity, with a CVSS score of 3.1, published 10 May 2021.
- Which products and versions are affected?
- json-ptr (npm) before 2.1.0.
- Is there a fix for CVE-2020-7766?
- A patch was published on 2021: Fixed in version 2.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-7766 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-7766?
- Check whether you run json-ptr (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a prototype pollution issue in json-ptr before version 2.1.0, occurring in the set operation when the force flag is set to true. The function recursively sets properties in the target object without properly sanitizing the key being set, allowing an attacker to inject escape sequences and break out of the intended property assignment context. The vulnerability can be triggered via specially crafted JSON pointer paths containing quote characters (e.g., '/aaa\'\]\)\)') that are not properly escaped, enabling arbitrary code execution. The fix involves properly escaping single quotes and backslashes in the pointer path using .replace() calls. No authentication is required, and the attack vector is network-accessible if the library processes untrusted input.
Affected products
- npm json-ptr before 2.1.0
Identifiers
- CVE-2020-7766
- GHSA-x5r6-x823-9848
Timeline
- 2020-11-10: disclosed: NVD publication date
- 2021-05-10: advisory: GHSA advisory published
- 2021: patched: Fixed in version 2.1.0