by Kastro
Paper/Archive/CVE-2024-21534

CVE-2024-21534

jsonpath-plus jsonpath — All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.

EPSS 9%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.3.953 × 2019.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).

Affected

ProductAffectedFixed inSource
jsonpath-plusall versions–CNA
org.webjars.npm:jsonpath-plusall versions–CNA
jsonpath< 10.0.710.0.7CISA-ADP

Scores by source

snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884refsecurity.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019refgithub.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0refgithub.com/JSONPath-Plus/JSONPath/issues/226