Executive brief
nobelprizeparser is a Node.js library for parsing Nobel Prize data. The library uses the dangerous eval() function to parse input data, allowing an attacker to inject and execute arbitrary code. If an application uses this library to process untrusted data (such as from external APIs or user input), the attacker can gain complete control over the application and underlying server.
Technical details
The vulnerability is a classic code injection flaw (CWE-94) in the Parser constructor, which uses eval() to parse JSON data instead of the safe JSON.parse() method. The vulnerable code is: `this.laureates = eval(`(${data}`).laureates;`. An attacker who controls the input data can craft a malicious string that executes arbitrary JavaScript code when eval() processes it. The attack requires the application to pass untrusted or attacker-controlled data to the Parser constructor. No authentication or user interaction is required if the input source is network-accessible. The fix, implemented in version 1.0.2, replaces eval() with JSON.parse(), which safely parses JSON without executing code.
Affected products
- AnneTheDev nobelprizeparser < 1.0.2
Timeline
- 2021-02-23: disclosed
- 2021-03-12: advisory
- 2021-02-23: patched: Version 1.0.2 released with fix replacing eval with JSON.parse