Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lookup function within src/functions.js. The provided security advisory and commit patches clearly indicate that this function was missing a crucial security check. Specifically, the function did not use hasOwnProperty to verify that a requested property existed directly on the input object before accessing it. This oversight allowed for prototype traversal, enabling an attacker to access and manipulate properties of the global Object.prototype. The proof-of-concept demonstrates how to leverage this to gain access to the constructor property and execute arbitrary commands via child_process. The fix, present in both commits 4c5f4adfb90a9b500889d50f90050ca68888b50d and 4b217d514376e30cba278941298d7ba97c4a6c6e, introduces the Object.prototype.hasOwnProperty.call(input, key) check, which mitigates the vulnerability by ensuring only the object's own properties are accessed. Therefore, the lookup function is the direct source of the vulnerability.
lookupsrc/functions.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jsonata | npm | <= 1.8.7 | 1.8.8 |
| jsonata | npm | >= 2.0.0, < 2.2.0 | 2.2.0 |