Executive brief
json-ptr is a JavaScript library for parsing and manipulating JSON pointer references. A type confusion vulnerability allows attackers to bypass an earlier security fix (CVE-2020-7766) by supplying array values in pointer keys, potentially leading to unintended property modifications or information disclosure in applications that use this library to process untrusted JSON data.
Technical details
The vulnerability is a prototype pollution issue caused by type confusion in json-ptr versions before 3.0.0. When user-provided keys in the pointer parameter are arrays instead of expected string types, the vulnerable code fails to properly validate the input, allowing attackers to bypass the protections added for CVE-2020-7766. This is a network-reachable vulnerability affecting any application that processes untrusted pointer specifications. Successful exploitation enables modification of object prototypes or properties, potentially leading to privilege escalation, data integrity compromise, or information disclosure. The fix was released in version 3.0.0.
Affected products
- flitbit json-ptr before 3.0.0
Timeline
- 2021-11-08: disclosed
- 2021-11-08: patched: Fixed in version 3.0.0