Executive brief
jsonic is a popular JSON parser library used in Node.js applications. A prototype pollution flaw allows attackers to inject malicious properties into JavaScript's core Object prototype, which affects all objects in the application. This can enable remote code execution, service disruption, or other attacks depending on how the application uses these objects.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-94) affecting the empty, util.clone, util.prop, util.deep, and make functions in jsonic-next. The vulnerable functions fail to sanitize user-supplied input and allow attackers to pass arguments containing __proto__ properties that pollute the Object.prototype chain. An attacker needs no authentication and can trigger the vulnerability remotely by providing specially crafted JSON input through the affected functions. Successful exploitation allows arbitrary property injection into all objects inheriting from Object, potentially enabling denial of service, remote code execution, or cross-site scripting depending on available gadget chains in the application. No patch has been released as of the advisory date; the advisory was withdrawn on 2024-07-12, suggesting the maintainer may have disputed the severity or requestability of the vulnerability using undocumented internal APIs.
Affected products
- rjrodger jsonic 2.12.1 and earlier
- rjrodger jsonic-next 2.12.1 and earlier
Timeline
- 2024-07-01: disclosed
- 2024-07-01: advisory: GHSA-4wm9-3qmv-gvxj published
- 2024-07-12: other: Advisory withdrawn by GitHub; maintainer questioned whether the vulnerability affects the public API