Executive brief
React Editable Json Tree is a popular JavaScript library used to display and edit JSON data in web applications. The library uses JavaScript's eval() function to parse function-type values in JSON, allowing attackers to execute arbitrary code if they can control the JSON data displayed—a critical risk when displaying untrusted data sources. This could result in complete compromise of the application and user data theft.
Technical details
The vulnerability is an eval injection (CWE-95) in the default onSubmitValueParser callback function. When parsing JSON values that begin with "function", the library uses eval() to execute them as JavaScript code. An attacker who controls JSON input can inject malicious code as a function string, which will be executed immediately with full access to the application context. The vulnerability affects all versions prior to 2.2.2, where the default behavior allows code execution. Versions 2.2.2 introduce an allowFunctionEvaluation prop (enabled by default for backwards-compatibility), and version 3.0.0+ disables function evaluation by default. Users with custom onSubmitValueParser callbacks are unaffected.
Affected products
- oxyno-zeta react-editable-json-tree <2.2.2
Timeline
- 2022-08-13: disclosed
- 2022-08-18: patched: Version 2.2.2 released with mitigations; Function constructor used instead of eval()