CVE-2020-7777: Code Injection in jsen
Summary
CVE-2020-7777: Code Injection in jsen. Affects jsen versions < 0.6.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsen package is an npm package used for JSON schema validation. It provides a simple and convenient way to validate JSON data against a schema. However, all versions of the jsen package are vulnerable to code injection. If an attacker can control the schema file, they can execute arbitrary JavaScript code on the victim's machine. This vulnerability arises from the improper sanitization of the required field in the schema definition. The resulting string is passed to a Function.apply() call, enabling arbitrary code execution.
Vulnerability Detail
The vulnerability allows an attacker to inject malicious JavaScript code by manipulating the schema file. This can lead to arbitrary code execution on the victim's machine. The lack of warning about the risks of untrusted schema files in the module description and README file makes this vulnerability particularly dangerous. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2. The vulnerability is classified under CWE-94 (Code Injection).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of jsen to mitigate the risk of code injection.
Conclusion
The jsen package is vulnerable to code injection, allowing an attacker to execute arbitrary JavaScript code on the victim's machine. To mitigate this risk, it is crucial to update to the latest version of jsen (0.6.7) and validate/sanitize user-controlled input. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for jsen →
FAQ
jsen is an npm package used for JSON schema validation. It provides a convenient way to validate JSON data against a schema.
The vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's machine by manipulating the schema file. This can lead to various malicious activities, including data theft, unauthorized access, and system compromise.
To fix this vulnerability, update the jsen package to version 0.6.7 or later, which includes a patch for this issue. Make sure to validate and sanitize any user-controlled input, such as the schema file, to prevent code injection attacks.
There is no known workaround for this vulnerability. It is crucial to update to the patched version of jsen to mitigate the risk of code injection.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.2.
