CVE-2024-27307 (published 2024-03-06T20:15Z)

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jsonata-js/jsonata
commit_details: repo_url: https://github.com/jsonata-js/jsonata
author: Matt
author_date: 2024-02-29 00:54:29+00:00
msg: Check for constructor property
repository: repo_url: https://github.com/jsonata-js/jsonata
repo_name: jsonata-js/jsonata
description: JSONata query and transformation language - http://jsonata.org
repo_language: JavaScript
owner: jsonata-js
file_changes: filename: jsonata.js
change_type: ModificationType.MODIFY
diff: @@ -1293,7 +1293,7 @@ var jsonata = (function() {
                 }
                 for(var ii = 0; ii < matches.length; ii++) {
                     var match = matches[ii];
-                    if (match && match.isPrototypeOf(result)) {
+                    if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) {
                         throw {
                             code: "D1010",
                             stack: (new Error()).stack,

programming_language: JavaScript
filename: implementation-tests.js
change_type: ModificationType.MODIFY
diff: @@ -974,6 +974,15 @@ describe("Tests that are specific to a Javascript runtime", () => {
                 code: "D1010",
             });
         });
+        it("should throw an error with constructor", async function() {
+            const expr = jsonata('{} ~> | constructor | {"is_admin": true} |');
+            expect(
+                expr.evaluate()
+            ).to.eventually.be.rejected.to.deep.contain({
+                position: 7,
+                code: "D1010",
+            });
+        });
     });
 });
 

programming_language: JavaScript
repo_url: https://github.com/jsonata-js/jsonata
commit_details: repo_url: https://github.com/jsonata-js/jsonata
author: andrew-coleman
author_date: 2024-02-27 09:11:11+00:00
msg: Prevent access to __proto__

Signed-off-by: andrew-coleman <andrew_coleman@uk.ibm.com>
repository: repo_url: https://github.com/jsonata-js/jsonata
repo_name: jsonata-js/jsonata
description: JSONata query and transformation language - http://jsonata.org
repo_language: JavaScript
owner: jsonata-js
file_changes: filename: jsonata.js
change_type: ModificationType.MODIFY
diff: @@ -1293,6 +1293,13 @@ var jsonata = (function() {
                 }
                 for(var ii = 0; ii < matches.length; ii++) {
                     var match = matches[ii];
+                    if (match && match.isPrototypeOf(result)) {
+                        throw {
+                            code: "D1010",
+                            stack: (new Error()).stack,
+                            position: expr.position
+                        };
+                    }
                     // evaluate the update value for each match
                     var update = await evaluate(expr.update, match, environment);
                     // update must be an object
@@ -1539,7 +1546,7 @@ var jsonata = (function() {
                 if (typeof err.token == 'undefined' && typeof proc.token !== 'undefined') {
                     err.token = proc.token;
                 }
-                err.position = proc.position;
+                err.position = proc.position || err.position;
             }
             throw err;
         }
@@ -1972,6 +1979,7 @@ var jsonata = (function() {
         "T1007": "Attempted to partially apply a non-function. Did you mean ${{{token}}}?",
         "T1008": "Attempted to partially apply a non-function",
         "D1009": "Multiple key definitions evaluate to same key: {{value}}",
+        "D1010": "Attempted to access the Javascript object prototype", // Javascript specific 
         "T1010": "The matcher function argument passed to function {{token}} does not return the correct object structure",
         "T2001": "The left side of the {{token}} operator must evaluate to a number",
         "T2002": "The right side of the {{token}} operator must evaluate to a number",

programming_language: JavaScript
filename: implementation-tests.js
change_type: ModificationType.MODIFY
diff: @@ -955,6 +955,26 @@ describe("Tests that are specific to a Javascript runtime", () => {
             });
         });
     });
+    describe("Expressions that attempt to pollute the object prototype", function() {
+        it("should throw an error with __proto__", async function() {
+            const expr = jsonata('{} ~> | __proto__ | {"is_admin": true} |');
+            expect(
+                expr.evaluate()
+            ).to.eventually.be.rejected.to.deep.contain({
+                position: 7,
+                code: "D1010",
+            });
+        });
+        it("should throw an error with __lookupGetter__", async function() {
+            const expr = jsonata('{} ~> | __lookupGetter__("__proto__")() | {"is_admin": true} |');
+            expect(
+                expr.evaluate()
+            ).to.eventually.be.rejected.to.deep.contain({
+                position: 7,
+                code: "D1010",
+            });
+        });
+    });
 });
 
 describe("Test that yield platform specific results", () => {

programming_language: JavaScript