CVE-2019-19507: Validation bypass in Json Pattern Validator
Summary
CVE-2019-19507: Validation bypass is possible in Json Pattern Validator. Affects jpv versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Json Pattern Validator (jpv) is an npm package that provides a mechanism for validating JSON data against predefined patterns. It is commonly used in applications that require strict validation of JSON input. The package allows developers to define patterns and validate JSON objects against those patterns. However, a vulnerability exists in versions prior to 2.1.1 that allows for validation bypass.
Vulnerability Detail
The vulnerability in jpv arises from a flaw in the compareCommon() function, which can be bypassed by overwriting certain internal attributes. Specifically, the 'constructor' attribute can be overwritten with a conflicting name, such as {'name':'Array'}. This manipulation of the built-in attribute can lead to the manipulation of type detection results in the validate() function. An attacker can craft a payload to exploit this vulnerability and bypass the validation process, potentially leading to the acceptance of malicious or malformed JSON data.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
npm install jpv@2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of the jpv package to mitigate the risk.
Conclusion
The Json Pattern Validator (jpv) package prior to version 2.1.1 is vulnerable to a validation bypass issue. This vulnerability can allow for the acceptance of malicious or malformed JSON data, potentially leading to security vulnerabilities or incorrect data processing. It is crucial to update to the patched version of the package to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jpv →
FAQ
The vulnerability allows for validation bypass, which can lead to the acceptance of malicious or malformed JSON data. This can potentially result in security vulnerabilities or incorrect processing of data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update to the patched version to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
For more information about this vulnerability, you can refer to the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-rh46-3fgc-mvrf/GHSA-rh46-3fgc-mvrf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for jpv.
