Executive brief
json-ptr is a JavaScript library for accessing values within JSON objects using pointer notation. If an application passes unsanitized user input to the library's .get() method, an attacker can inject malicious code that will be executed on the server, potentially leading to data theft, service disruption, or system compromise.
Technical details
This is an code injection vulnerability (CWE-74) in json-ptr versions prior to v2.1.0, specifically in the .get() method. The vulnerability stems from insufficient input sanitization when processing user-supplied pointer locations; attackers can break out of the intended expression context by injecting single quotes and additional code. An attacker who can control the pointer parameter passed to .get() (for example, via HTTP requests) can achieve arbitrary code execution. The fix, released in v2.1.0, implements proper escaping of single quotes and backslashes in the pointer path.
Affected products
- flitbit json-ptr prior to v2.1.0
Timeline
- 2021-05-26: disclosed
- 2021-05-26: patched: v2.1.0 released with security fix