Executive brief
JSONata is a JavaScript query and transformation language used to extract and manipulate data from JSON. A flaw in versions 1.4.0–1.8.6 and 2.0.0–2.0.3 allows malicious expressions to override critical properties on the Object prototype, potentially leading to denial of service, remote code execution, or application crashes in systems that evaluate untrusted JSONata code.
Technical details
This is a prototype pollution vulnerability in JSONata's transform operator. The vulnerable code fails to prevent the transform operator from modifying Object.prototype and Object.constructor properties via the $ (match) and ~ (update) operators. An attacker can craft a JSONata expression that pollutes the Object prototype, affecting all objects created after the pollution occurs. This requires the application to evaluate user-supplied JSONata expressions. The fix, implemented in versions 1.8.7 and 2.0.4, adds validation to detect and reject attempts to modify JavaScript object prototypes by checking if a match target is a prototype or Object.constructor instance.
Affected products
- JSONata JSONata >=1.4.0, <1.8.7; >=2.0.0, <2.0.4
Timeline
- 2024-03-04: disclosed: Advisory published
- 2024-03-04: patched: Fix released in versions 1.8.7 and 2.0.4