Executive brief
json-logic-js is a JavaScript library that evaluates logical rules in JSON format, commonly used in web applications for conditional logic and data validation. A prototype pollution vulnerability in versions before 2.0.0 allows attackers to inject malicious code that modifies core JavaScript object behavior, potentially leading to unauthorized data access, application hijacking, or remote code execution in affected systems.
Technical details
The vulnerability is a prototype pollution (CWE-471) flaw in the `method` operator of json-logic-js prior to version 2.0.0. An attacker can craft a malicious JSON rule that uses the `method` property to modify the `__proto__` property, polluting Object.prototype and affecting all objects in the application. The attack requires the attacker to control the JSON rule being evaluated (via untrusted input passed to json-logic-js); no authentication bypass is required if rules are parsed from external sources. Successful exploitation enables arbitrary property injection and, in browser contexts, can lead to JavaScript execution through constructor manipulation. The fix involves removing the vulnerable `method` operator entirely, implemented in version 2.0.0.
Affected products
- json-logic-js json-logic-js prior to 2.0.0
Timeline
- 2020-11-12: disclosed
- 2020-11-12: patched: Version 2.0.0 removes the vulnerable method operator