CVE-2021-4329: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-03-05T19:15Z
Repository: https://github.com/jwadhams/json-logic-js
Language: JSON
Files changed: logic.js, package.json
Commit date: 2021-03-30 09:46:06 -0500
Commit message: The operations object could be exploited to run arbitrary code (#98)

* The operations object could be exploited to run arbitrary code

* Version bump

Co-authored-by: Jeremy Wadhams <jwadhams@dealerinspire.com>
Diff: diff --git a/logic.js b/logic.js
index 54dadc1..137a259 100644
--- a/logic.js
+++ b/logic.js
@@ -338,22 +338,23 @@ http://ricostacruz.com/cheatsheets/umdjs.html
 
 
     // The operation is called with "data" bound to its "this" and "values" passed as arguments.
     // Structured commands like % or > can name formal arguments while flexible commands (like missing or merge) can operate on the pseudo-array arguments
     // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/arguments
-    if (typeof operations[op] === "function") {
+    if (operations.hasOwnProperty(op) && typeof operations[op] === "function") {
       return operations[op].apply(data, values);
     } else if (op.indexOf(".") > 0) { // Contains a dot, and not in the 0th position
       var sub_ops = String(op).split(".");
       var operation = operations;
       for (i = 0; i < sub_ops.length; i++) {
-        // Descending into operations
-        operation = operation[sub_ops[i]];
-        if (operation === undefined) {
+
+        if (!operation.hasOwnProperty(sub_ops[i])) {
           throw new Error("Unrecognized operation " + op +
             " (failed at " + sub_ops.slice(0, i+1).join(".") + ")");
         }
+        // Descending into operations
+        operation = operation[sub_ops[i]];
       }
 
       return operation.apply(data, values);
     }
 
diff --git a/package.json b/package.json
index 10b0fd3..c614a8c 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "json-logic-js",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Build complex rules, serialize them as JSON, and execute them in JavaScript",
   "main": "logic.js",
   "directories": {
     "test": "tests"
   },

Vulnerable code:     if (typeof operations[op] === "function") {
        // Descending into operations
        operation = operation[sub_ops[i]];
        if (operation === undefined) {
  "version": "2.0.0",
Fixed code:     if (operations.hasOwnProperty(op) && typeof operations[op] === "function") {

        if (!operation.hasOwnProperty(sub_ops[i])) {
        // Descending into operations
        operation = operation[sub_ops[i]];
  "version": "2.0.1",