CVE-2024-21534: JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. Note: There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
Published Oct 11, 2024 · Updated Feb 6, 2025
Affected packages
org.webjars.npm:jsonpath-plus
- Ecosystem
- Maven
- Affected
- <= 6.0.1
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.webjars.npm:jsonpath-plus
jsonpath-plus
- Ecosystem
- npm
- Affected
- < 10.2.0
- Fixed in
- 10.2.0
- Check
npm ls jsonpath-plus
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.
Note:
There were several attempts to fix it in versions 10.0.0-10.1.0 but it could still be exploited using different payloads
Credited to jdong10, RisingZero.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534
- https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3
- https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019
- https://github.com/JSONPath-Plus/JSONPath/issues/226
- https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72
- https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316
- https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0
- https://github.com/JSONPath-Plus/JSONPath/pull/233
- https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8
- https://github.com/advisories/GHSA-pppg-cpfq-h7wr
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology