Prototype Pollution Vulnerability in JSON5 Package
Summary
CVE-2022-46175: JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. Affects node-json5 across 2 version ranges.
< 2.1.3-2+deb11u1
< a62db1e51e1031d92ac260f5bb38bbed1fdbc754
Fixed in 2.1.3-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JSON5 is an extension of the JSON format designed to make it easier for humans to write and maintain configuration files. It allows for more flexible syntax, such as comments and unquoted keys. However, certain versions of JSON5 are vulnerable to a prototype pollution issue, which can lead to significant security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the parse method of the JSON5 library, which does not restrict the parsing of keys named __proto__. This oversight allows attackers to manipulate the prototype of the object returned by JSON5.parse, potentially leading to arbitrary key assignments. The impact of this vulnerability can vary based on how applications utilize the returned object, with possible consequences including denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. Unlike the standard JSON.parse method in JavaScript, which ignores __proto__ keys, JSON5's lack of restriction poses a serious threat to application security.
How To Fix
Minimum fixed version
2.1.3-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-json5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can replace instances of JSON5.parse with JSON.parse in your code, which will ignore __proto__ keys. For example:
const json5 = require('json5');
const safeParse = (input) => JSON.parse(input);
This will mitigate the vulnerability until you can update to a secure version of JSON5.
Conclusion
The JSON5 package has a significant vulnerability related to prototype pollution that can lead to serious security risks. It is crucial for developers to update to the patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for node-json5 →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of an object, potentially leading to unexpected behavior in applications.
The affected versions of JSON5 are all versions before 1.0.2 and 2.2.2.
The impacts can include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-json5.
