Executive brief
JSON-Patch is a JavaScript library used to apply changes to JSON documents programmatically. A prototype pollution vulnerability allows attackers to modify the prototype chain of JavaScript objects, potentially corrupting shared object properties across an application. This could enable attackers to bypass security checks, inject malicious code, or cause unexpected application behavior without requiring authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in JSON-Patch versions up to 3.1.0 that allows improperly controlled modification of object prototype attributes. The vulnerability is triggered through malicious JSON-Patch operations that manipulate the object prototype chain. The attack vector is network-based with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). An attacker can achieve confidentiality, integrity, and availability impacts by poisoning shared prototype objects. The issue was patched in version 3.1.1 via commit 7ad6af41eabb2d799f698740a91284d762c955c9.
Affected products
- Starcounter-Jack JSON-Patch up to 3.1.0
Timeline
- 2022-12-25: disclosed
- 2021-08-13: patched: Fix merged to master