CVE-2020-7766: Arbitrary Code Execution in json-ptr
Summary
CVE-2020-7766: Arbitrary Code Execution in json-ptr. Affects json-ptr versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-ptr package is an npm package that provides functionality for working with JSON pointers. It allows users to manipulate JSON data by specifying a path to a specific value within the JSON structure. This vulnerability affects versions of json-ptr prior to 2.1.0. The package is vulnerable to arbitrary code execution when the 'set' operation is used with the 'force' flag set to true. This vulnerability arises due to improper key checking during the recursive property setting process, leading to prototype pollution.
Vulnerability Detail
The vulnerability in json-ptr allows an attacker to execute arbitrary code by exploiting the 'set' operation with the 'force' flag set to true. This operation is used to recursively set properties in the target object. However, the package fails to properly validate the key being set, which can result in the pollution of the object's prototype. This can lead to various security issues, such as remote code execution, privilege escalation, and data manipulation. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.3.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
npm install json-ptr@2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed version of the json-ptr package.
Conclusion
The json-ptr package prior to version 2.1.0 is vulnerable to arbitrary code execution. It is crucial to update to the fixed version (2.1.0 or later) to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json-ptr →
FAQ
json-ptr is an npm package that provides functionality for working with JSON pointers. It allows users to manipulate JSON data by specifying a path to a specific value within the JSON structure.
This vulnerability can lead to arbitrary code execution, remote code execution, privilege escalation, and data manipulation.
To fix this vulnerability, update the json-ptr package to version 2.1.0 or later by running the command: npm install json-ptr@2.1.0
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the json-ptr package.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for json-ptr.
