Miggo Logo

CVE-2020-7777: Code Injection in jsen

7.2

CVSS Score
3.1

Basic Information

EPSS Score
0.7577%
Published
2/10/2022
Updated
9/11/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
jsennpm<= 0.6.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurs in the processing of the 'required' field in JSON schemas. The code responsible for handling the 'required' keyword (keywords.required function) dynamically generates validation checks by concatenating user-controlled schema values into executable code strings. The PoC demonstrates that malicious values in the 'required' array (containing JavaScript code) get directly embedded into the generated validation function. This unsanitized code is then executed via Function.apply(), leading to arbitrary code execution. The code at line 875 of jsen.js (referenced in advisories) shows the pattern of building executable strings from schema values without proper sanitization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*is *****ts *ll v*rsions o* p**k*** js*n. I* *n *tt**k*r **n *ontrol t** s***m* *il*, it *oul* run *r*itr*ry J*v*S*ript *o** on t** vi*tim m***in*. In t** mo*ul* **s*ription *n* R***M* *il* t**r* is no m*ntion **out t** risks o* untrust** s***m* *il

Reasoning

T** vuln*r**ility o**urs in t** pro**ssin* o* t** 'r*quir**' *i*l* in JSON s***m*s. T** *o** r*sponsi*l* *or **n*lin* t** 'r*quir**' k*ywor* (`k*ywor*s.r*quir**` *un*tion) *yn*mi**lly **n*r*t*s v*li**tion ****ks *y *on**t*n*tin* us*r-*ontroll** s***m