Executive brief
deep-parse-json is a Node.js library used to parse JSON data in JavaScript applications. An attacker can exploit a prototype pollution flaw to modify object properties, potentially allowing unauthorized modification of application behavior or data integrity attacks against systems using this library.
Technical details
The vulnerability is a prototype pollution flaw in deep-parse-json version 1.0.2 caused by insufficient validation of JSON keys during parsing. An attacker can craft malicious JSON input containing the __proto__ property to pollute the prototype chain and inject or modify properties on all objects in the application. The attack requires only network access to send the malicious JSON payload; no authentication or user interaction is needed. An attacker can achieve unauthorized modification of object properties, which may lead to logic bypass, privilege escalation, or data tampering depending on how the affected application uses the parsed objects. Patches or fixes should be available from the maintainer.
Affected products
- sibu-github deep-parse-json 1.0.2 and earlier
Timeline
- 2022-11-04: disclosed
- 2022-11-03: advisory: NVD published