CVE-2022-32511: JMESPath for Ruby unsafe deserialization in jmespath.rb

Executive brief

JMESPath for Ruby, a library used to search and manipulate JSON data, contains a critical security flaw in how it processes information. An attacker could use this vulnerability to execute unauthorized code or take control of an application that uses this library. This could lead to the theft of sensitive customer data or a complete disruption of business operations.

Technical details

JMESPath for Ruby (jmespath.rb) prior to version 1.6.1 utilizes the unsafe Ruby method JSON.load for deserializing data. This constitutes a CWE-502 (Deserialization of Untrusted Data) vulnerability, as JSON.load can be leveraged to instantiate arbitrary Ruby objects, potentially leading to remote code execution (RCE). The vulnerability can be exploited over the network without authentication or user interaction if the application passes untrusted input to the library's parsing functions. The issue was addressed in version 1.6.1 by switching to the safer JSON.parse method.

Affected products

• JMESPath jmespath.rb < 1.6.1

Timeline

• 2022-06-06: advisory: NVD publication date
• 2022-06-07: disclosed: GitHub Advisory published
• 2022-06-07: patched: Version 1.6.1 released

References

• https://api.github.com/users/plygrnd
• https://github.com/plygrnd
• https://api.github.com/users/plygrnd/gists%7B/gist_id%7D
• https://api.github.com/users/plygrnd/repos
• https://avatars.githubusercontent.com/u/21295236?v=4
• https://api.github.com/users/plygrnd/events%7B/privacy%7D