Arbitrary Code Execution in json-ptr
Summary
GHSA-rrqv-vjrw-hrcr: Arbitrary Code Execution in json-ptr. Affects json-ptr versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-ptr package is an npm package that provides functionality for working with JSON Pointers. JSON Pointers are a way to reference specific values within a JSON document. The package allows users to manipulate and retrieve values from JSON documents using these pointers. However, versions prior to v2.1.0 of json-ptr are vulnerable to an arbitrary code execution vulnerability.
Vulnerability Detail
The vulnerability in json-ptr versions prior to v2.1.0 allows an unscrupulous actor to execute arbitrary code. If user input is not properly sanitized before being passed to the .get() method of json-ptr, an injection-style vulnerability can be exploited. This can lead to unauthorized code execution and potentially enable an attacker to gain control over the affected system. The vulnerability has been assigned a severity rating of HIGH and is categorized under CWE-74.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
npm install json-ptr@2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to ensure that all user input passed to the .get() method is properly sanitized and validated. This can be achieved by implementing input validation and sanitization techniques, such as using a JSON schema validator or carefully parsing and validating the input before passing it to the .get() method.
Conclusion
In conclusion, the json-ptr package prior to v2.1.0 is vulnerable to arbitrary code execution. It is crucial to upgrade to the latest version or apply proper input validation and sanitization techniques to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for json-ptr →
FAQ
json-ptr is an npm package that provides functionality for working with JSON Pointers. JSON Pointers are a way to reference specific values within a JSON document.
The vulnerability in json-ptr versions prior to v2.1.0 allows an unscrupulous actor to execute arbitrary code by injecting malicious input into the .get() method.
The vulnerability can lead to unauthorized code execution and potentially enable an attacker to gain control over the affected system.
To fix the vulnerability, it is recommended to upgrade to json-ptr version 2.1.0 or later.
If upgrading to the latest version is not immediately feasible, a possible workaround is to ensure that all user input passed to the .get() method is properly sanitized and validated.
References
Related vulnerabilities
Recent vulnerabilities recorded for json-ptr.
