CVE-2021-23807: Prototype Pollution in node-jsonpointer
Summary
CVE-2021-23807: Prototype Pollution in node-jsonpointer. Affects jsonpointer versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Also tracked for
- jsonpointer · ghsa
The same CVE-2021-23807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is jsonpointer, an npm package used for manipulating JSON data by referencing specific parts of the data structure using a pointer. It provides a set of functions to navigate and modify JSON objects based on the JSON Pointer specification. The package is widely used in Node.js applications for JSON manipulation tasks.
Vulnerability Detail
The vulnerability identified as CVE-2021-23807 affects versions of jsonpointer prior to 5.0.0. It is a type confusion vulnerability that can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. This vulnerability allows an attacker to modify the prototype of objects in the JSON structure, potentially leading to arbitrary code execution or other malicious activities. The impact of this vulnerability can vary depending on the usage of the affected package in the application.
How To Fix
Minimum fixed version
5.0.0
This is the first release that contains the fix.
npm install jsonpointer@5.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk of exploitation.
Conclusion
In conclusion, the jsonpointer package prior to version 5.0.0 is vulnerable to Prototype Pollution. It is crucial for developers to upgrade to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for jsonpointer →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior or security issues. In the context of this vulnerability, it allows an attacker to manipulate the JSON structure by modifying the prototype of objects referenced by the JSON Pointer.
JSON Pointer is a syntax for specifying a specific part of a JSON document. It uses a string representation to navigate and reference elements within the JSON structure. The jsonpointer package provides functions to work with JSON Pointers in Node.js applications.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes the package-lock.json file of your application and alerts in real-time for open-source vulnerabilities, including this one.
The severity of this vulnerability is considered moderate, with a CVSS score of 5.6. However, the impact may vary depending on the usage of the affected package in the application and the specific context in which it is used.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-282f-qqgm-c34q/GHSA-282f-qqgm-c34q.json
