CVE-2021-23807: Vulnerability in jsonpointer Package
Summary
CVE-2021-23807: This affects the package jsonpointer before 5.0.0. Affects jsonpointer versions < 5.0.0. Fixed in 5.0.0. How to fix ↓
Also tracked for
- jsonpointer · npm
The same CVE-2021-23807 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jsonpointer package is a library used in Node.js applications to manipulate JSON data using pointer strings. It provides functions to retrieve and modify values within a JSON object based on a given pointer. The vulnerability, identified as CVE-2021-23807, affects versions prior to 5.0.0 of the jsonpointer package. It is a type confusion vulnerability that can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Vulnerability Detail
The type confusion vulnerability in the jsonpointer package allows an attacker to manipulate JSON objects and potentially execute arbitrary code. By exploiting this vulnerability, an attacker can bypass previous fixes for Prototype Pollution attacks, which can lead to unauthorized modifications of object properties and potentially compromise the integrity and security of the application. This vulnerability specifically occurs when the pointer components are arrays, allowing an attacker to confuse the type checking mechanism and perform malicious operations.
How To Fix
Minimum fixed version
5.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the jsonpointer package to the fixed version to mitigate the risk of exploitation.
Conclusion
The jsonpointer package prior to version 5.0.0 is vulnerable to a type confusion issue that can lead to a bypass of a previous Prototype Pollution fix. To mitigate this vulnerability, it is crucial to update the package to version 5.0.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsonpointer →
FAQ
This vulnerability can allow an attacker to bypass previous Prototype Pollution fixes and potentially execute arbitrary code, leading to unauthorized modifications of object properties and potential compromise of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including CVE-2021-23807.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to update the jsonpointer package to the fixed version to prevent potential exploitation.
No, updating the jsonpointer package to the fixed version is the recommended solution to mitigate the risk of exploitation. There are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry at https://nvd.nist.gov/vuln/detail/CVE-2021-23807.
