Junglewise Threat Intelligence

json-ptr arbitrary code execution in .get() method

Severity: info · CVSS 8.6 · Published 2021-05-26

Technologies: json-ptr (npm). Vendors: npm.

Executive brief

json-ptr is a JavaScript library for accessing values within JSON objects using pointer notation. If an application passes unsanitized user input to the library's .get() method, an attacker can inject malicious code that will be executed on the server, potentially leading to data theft, service disruption, or system compromise.

Technical details

This is an code injection vulnerability (CWE-74) in json-ptr versions prior to v2.1.0, specifically in the .get() method. The vulnerability stems from insufficient input sanitization when processing user-supplied pointer locations; attackers can break out of the intended expression context by injecting single quotes and additional code. An attacker who can control the pointer parameter passed to .get() (for example, via HTTP requests) can achieve arbitrary code execution. The fix, released in v2.1.0, implements proper escaping of single quotes and backslashes in the pointer path.

Affected products

  • flitbit json-ptr prior to v2.1.0

Timeline

  • 2021-05-26: disclosed
  • 2021-05-26: patched: v2.1.0 released with security fix

References

Related threats