Executive brief
json8 is a JavaScript library for working with JSON data structures. The library's merge-patch functionality fails to validate object property names, allowing attackers to inject properties into the JavaScript Object prototype. This enables arbitrary code execution or denial of service affecting any application using the vulnerable library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the json8 library's add function used by merge-patch operations. When adding properties to a target object, the function does not properly validate the property key name, allowing attackers to specify paths like "__proto__" or "constructor.prototype" to modify the Object prototype. An attacker with network access can craft a malicious JSON patch and send it to an application using json8, without requiring authentication or user interaction. Exploitation allows arbitrary property injection into all objects, leading to code execution, data manipulation, or denial of service. The vulnerability is fixed in version 1.0.3 and later.
Affected products
- json8 json8 before 1.0.3
Timeline
- 2020-11-12: disclosed
- 2021-05-10: advisory
- 2021-04-19: patched: Fix committed; version 1.0.3 available