CVE-2024-27307
📋 TL;DR
This vulnerability in JSONata allows malicious expressions to override properties on the Object constructor and prototype, potentially leading to denial of service, remote code execution, or other unexpected behavior. It affects applications that evaluate user-provided JSONata expressions. The issue impacts JSONata versions 1.4.0 through 1.8.6 and 2.0.0 through 2.0.3.
💻 Affected Systems
- JSONata
📦 What is this software?
Jsonata by Jsonata
Jsonata by Jsonata
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service through application crashes or remote code execution in vulnerable applications.
If Mitigated
No impact if proper input validation, sandboxing, or updated versions are used.
🎯 Exploit Status
Exploitation requires the ability to submit malicious JSONata expressions to a vulnerable application. No public proof-of-concept has been released as of the advisory date.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.7 or 2.0.4
Vendor Advisory: https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8
Restart Required: No
Instructions:
1. Update JSONata package to version 1.8.7 or 2.0.4 using npm: npm update jsonata. 2. Verify the update with: npm list jsonata. 3. Test application functionality after update.
🔧 Temporary Workarounds
Manual patch application
allApply the security patches from GitHub commits to your local JSONata installation
git clone https://github.com/jsonata-js/jsonata.git
cd jsonata
git checkout 1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
npm install
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-provided JSONata expressions
- Sandbox JSONata evaluation in isolated environments or containers with limited permissions
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list jsonata | grep jsonataCheck Version:
npm list jsonata | grep jsonataVerify Fix Applied:
Verify installed version is 1.8.7 or higher for 1.x, or 2.0.4 or higher for 2.x📡 Detection & Monitoring
Log Indicators:
- Unusual JSONata expression patterns
- Application crashes or errors during JSONata evaluation
- Suspicious transform operator usage in expressions
Network Indicators:
- Unusually large or complex JSONata expressions in API requests
- Patterns matching known exploit attempts in expression payloads
SIEM Query:
source="application_logs" AND ("JSONata" OR "transform operator") AND (error OR crash OR exception)🔗 References
- https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
- https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c
- https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2
- https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8
- https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
- https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c
- https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2
- https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4
- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8
