Executive brief
The node-jsonpointer library, which is used to retrieve or set values within JSON objects using a specific path syntax, is vulnerable to prototype pollution. An attacker can exploit this to inject or modify properties on the base JavaScript object, potentially leading to application crashes, unauthorized data modification, or in some cases, remote code execution. This vulnerability specifically bypasses previous security fixes by using unexpected data types in the path components.
Technical details
The node-jsonpointer library before version 5.0.0 is vulnerable to prototype pollution due to a type confusion flaw. While the library previously implemented checks to block the '__proto__' string, these checks could be bypassed by providing the pointer components as nested arrays (e.g., [['__proto__']]). Because the library used strict equality (===) to check for forbidden strings, the comparison would return false when comparing a string to an array containing that string, while the underlying JavaScript engine would still coerce the array to a string when accessing the object property. This allows an attacker to manipulate the global Object prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the application environment. The issue is fixed in version 5.0.0.
Affected products
- janl jsonpointer < 5.0.0
- webjars org.webjars.npm:json-pointer < 5.0.0
Timeline
- 2021-08-31: disclosed: Vulnerability disclosed by Snyk Research Team.
- 2021-10-31: patched: Fix merged into master branch.
- 2021-11-03: advisory: NVD and Snyk published advisories.