CVE-2024-27307 JSONata expression can pollute the "Object" prototype
Attackers can inject malicious JSONata expressions to pollute the Object prototype, potentially causing remote code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27307?
CVE-2024-27307 is a critical code injection vulnerability in jsonata-js jsonata, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
Weakness: CWE-1321
Which versions are affected by CVE-2024-27307?
4 open source packages ship an affected version, including jsonata. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jsonata npm | From 1.4.0 | 1.8.7 |
jsonata npm | From 1.4.0 | 1.8.7 |
jsonata npm | From 2.0.0 | 2.0.4 |
jsonata npm | From 2.0.0 | 2.0.4 |
Products include Jsonata Jsonata.
How do I fix CVE-2024-27307?
Upgrade jsonata to a fixed version for your release line: 1.8.7 or 2.0.4.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-27307 being exploited?
There is no known exploitation of CVE-2024-27307 in the wild and no public exploit code.
Other vulnerabilities in jsonata-js jsonata
Sources
Also known as GHSA-fqg8-vfv7-8fj8.