CVE-2021-4329 (published 2023-03-05T19:15Z)

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/jwadhams/json-logic-js
commit_details: repo_url: https://github.com/jwadhams/json-logic-js
author: Jeremy Wadhams
author_date: 2021-03-30 09:46:06-05:00
msg: The operations object could be exploited to run arbitrary code (#98)

* The operations object could be exploited to run arbitrary code

* Version bump

Co-authored-by: Jeremy Wadhams <jwadhams@dealerinspire.com>
repository: repo_url: https://github.com/jwadhams/json-logic-js
repo_name: jwadhams/json-logic-js
description: Build complex rules, serialize them as JSON, and execute them in JavaScript
repo_language: JavaScript
owner: jwadhams
file_changes: filename: logic.js
change_type: ModificationType.MODIFY
diff: @@ -340,18 +340,19 @@ http://ricostacruz.com/cheatsheets/umdjs.html
     // The operation is called with "data" bound to its "this" and "values" passed as arguments.
     // Structured commands like % or > can name formal arguments while flexible commands (like missing or merge) can operate on the pseudo-array arguments
     // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/arguments
-    if (typeof operations[op] === "function") {
+    if (operations.hasOwnProperty(op) && typeof operations[op] === "function") {
       return operations[op].apply(data, values);
     } else if (op.indexOf(".") > 0) { // Contains a dot, and not in the 0th position
       var sub_ops = String(op).split(".");
       var operation = operations;
       for (i = 0; i < sub_ops.length; i++) {
-        // Descending into operations
-        operation = operation[sub_ops[i]];
-        if (operation === undefined) {
+
+        if (!operation.hasOwnProperty(sub_ops[i])) {
           throw new Error("Unrecognized operation " + op +
             " (failed at " + sub_ops.slice(0, i+1).join(".") + ")");
         }
+        // Descending into operations
+        operation = operation[sub_ops[i]];
       }
 
       return operation.apply(data, values);

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "json-logic-js",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Build complex rules, serialize them as JSON, and execute them in JavaScript",
   "main": "logic.js",
   "directories": {

programming_language: JavaScript