Executive brief
jsen is a JSON schema validator library for Node.js used to validate data against schema definitions. If an attacker can control the schema file, they can inject and execute arbitrary JavaScript code on the server running the validation, leading to complete system compromise.
Technical details
This is a code injection vulnerability (CWE-94) in the jsen schema validation library affecting all versions through 0.6.6. The vulnerability exists in how the "required" field of JSON schemas is processed—the library concatenates user-supplied schema data into a JavaScript string without proper sanitization, then passes the result to Function.apply() for evaluation. An attacker who can control the schema input (via configuration files, API requests, or external sources) can inject arbitrary JavaScript code that will execute with the privileges of the Node.js process. No authentication is required; the attack requires only the ability to influence the schema definition passed to jsen().
Affected products
- jsen jsen all versions through 0.6.6
Timeline
- 2020-11-23: disclosed
- 2022-02-10: advisory