CVE-2021-23807: janl node-jsonpointer prototype pollution via type confusion

CVE-2021-23807 · Severity: low · CVSS 3.1 · Published 2021-11-08

The node-jsonpointer library, which is used to retrieve or set values within JSON objects using a specific path syntax, is vulnerable to prototype pollution. An attacker can exploit this to inject or modify properties on the base JavaScript object, potentially leading to application crashes, unauthorized data modification, or in some cases, remote code execution. This vulnerability specifically bypasses previous security fixes by using unexpected data types in the path components.

Technologies: Janl Json-Pointer. Vendors: Janl, npm.

Quick answers

Is CVE-2021-23807 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-23807 being exploited in the wild.
How severe is CVE-2021-23807?
Low severity, with a CVSS score of 3.1, published 8 November 2021.
Which products and versions are affected?
Janl Json-Pointer < 5.0.0; jsonpointer (npm) SEMVER:introduced=0,fixed=5.0.0; org.webjars.npm:json-pointer (npm) SEMVER:introduced=0,fixed=5.0.0.
Is there a fix for CVE-2021-23807?
Yes. jsonpointer (npm): upgrade to 5.0.0 or later; org.webjars.npm:json-pointer (npm): upgrade to 5.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23807 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-23807?
Check whether you run Janl Json-Pointer, jsonpointer (npm) or org.webjars.npm:json-pointer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsonpointer (npm): upgrade to 5.0.0 or later
    npm install jsonpointer@5.0.0
  • org.webjars.npm:json-pointer (npm): upgrade to 5.0.0 or later
    npm install org.webjars.npm:json-pointer@5.0.0

Technical details

The node-jsonpointer library before version 5.0.0 is vulnerable to prototype pollution due to a type confusion flaw. While the library previously implemented checks to block the '__proto__' string, these checks could be bypassed by providing the pointer components as nested arrays (e.g., [['__proto__']]). Because the library used strict equality (===) to check for forbidden strings, the comparison would return false when comparing a string to an array containing that string, while the underlying JavaScript engine would still coerce the array to a string when accessing the object property. This allows an attacker to manipulate the global Object prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the application environment. The issue is fixed in version 5.0.0.

Affected products

  • janl jsonpointer < 5.0.0
  • webjars org.webjars.npm:json-pointer < 5.0.0

Identifiers

  • CVE-2021-23807
  • GHSA-282f-qqgm-c34q

Timeline

  • 2021-08-31: disclosed: Vulnerability disclosed by Snyk Research Team.
  • 2021-10-31: patched: Fix merged into master branch.
  • 2021-11-03: advisory: NVD and Snyk published advisories.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.