CVE-2024-27307: Insufficient Information (NVD-CWE-noinfo)
value: JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T20:15Z
Repository: https://github.com/jsonata-js/jsonata
Language: JavaScript
Files changed: src/jsonata.js, test/implementation-tests.js
Commit date: 2024-02-29 16:43:10 +0000
Commit message: Check for constructor property

Diff: diff --git a/src/jsonata.js b/src/jsonata.js
index 199b7df..b7dfad5 100644
--- a/src/jsonata.js
+++ b/src/jsonata.js
@@ -1291,11 +1291,11 @@ var jsonata = (function() {
                 if(!Array.isArray(matches)) {
                     matches = [matches];
                 }
                 for(var ii = 0; ii < matches.length; ii++) {
                     var match = matches[ii];
-                    if (match && match.isPrototypeOf(result)) {
+                    if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) {
                         throw {
                             code: "D1010",
                             stack: (new Error()).stack,
                             position: expr.position
                         };
diff --git a/test/implementation-tests.js b/test/implementation-tests.js
index ace6efe..6df7e67 100644
--- a/test/implementation-tests.js
+++ b/test/implementation-tests.js
@@ -972,10 +972,19 @@ describe("Tests that are specific to a Javascript runtime", () => {
             ).to.eventually.be.rejected.to.deep.contain({
                 position: 7,
                 code: "D1010",
             });
         });
+        it("should throw an error with constructor", async function() {
+            const expr = jsonata('{} ~> | constructor | {"is_admin": true} |');
+            expect(
+                expr.evaluate()
+            ).to.eventually.be.rejected.to.deep.contain({
+                position: 7,
+                code: "D1010",
+            });
+        });
     });
 });
 
 describe("Test that yield platform specific results", () => {
     // Platform specific

Vulnerable code:                     if (match && match.isPrototypeOf(result)) {
Fixed code:                     if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) {
        it("should throw an error with constructor", async function() {
            const expr = jsonata('{} ~> | constructor | {"is_admin": true} |');
            expect(
                expr.evaluate()
            ).to.eventually.be.rejected.to.deep.contain({
                position: 7,
                code: "D1010",
            });
        });