CVE-2022-36010

Arbitrary code execution via function parsing in react-editable-json-tree

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom [`onSubmitValueParser`](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) callback prop on the [`JsonTree`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) component should be ***unaffected***. This vulnerability exists in the default `onSubmitValueParser` prop which calls [`parse`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Prop is added to `JsonTree` called `allowFunctionEvaluation`. This prop will be set to `true` in v2.2.2, which allows upgrade without losing backwards-compatibility. In v2.2.2, we switched from using `eval` to using [`Function`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) to construct anonymous functions. This is better than `eval` for the following reasons: - Arbitrary code should not be able to execute immediately, since the `Function` constructor explicitly *only creates* anonymous functions - Functions are created without local closures, so they only have access to the global scope If you use: - **Version `<2.2.2`**, you must upgrade as soon as possible. - **Version `^2.2.2`**, you must explicitly set `JsonTree`'s `allowFunctionEvaluation` prop to `false` to fully mitigate this vulnerability. - **Version `>=3.0.0`**, `allowFunctionEvaluation` is already set to `false` by default, so no further steps are necessary.

Esta biblioteca permite que las cadenas sean analizadas como funciones y almacenadas como un componente especializado, ["JsonFunctionValue"](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). Para ello, es usada la función ["eval"](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) de Javascript para ejecutar las cadenas que empiezan por "function" como Javascript. Lamentablemente, esto podría permitir una ejecución de código arbitrario si se presenta como valor dentro de la estructura JSON que está siendo mostrada. Dado que este componente puede ser usado a menudo para mostrar datos de fuentes arbitrarias y no confiables, esto es extremadamente peligroso. Una nota importante es que los usuarios que han definido una devolución de llamada personalizada ["onSubmitValueParser"](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) en el componente ["JsonTree"](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) deberían estar ***no afectados***. Esta vulnerabilidad se presenta en la proposición por defecto "onSubmitValueParser" que llama a ["parse"](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Es añadida una propiedad a "JsonTree" llamada "allowFunctionEvaluation". Esta proposición será establecida como "true" en versión v2.2.2, lo que permite la actualización sin perder la retrocompatibilidad. En versión v2.2.2, pasamos de usar "eval" a usar ["Function"](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) para construir funciones anónimas. Esto es mejor que "eval" por las siguientes razones: - El código arbitrario no debería poder ejecutarse inmediatamente, ya que el constructor "Function" explícitamente *sólo crea* funciones anónimas - Las funciones son creadas sin cierres locales, por lo que sólo presentan acceso al ámbito global Si usa: - **Versión "<2.2.2"**, debe actualizar cuanto antes. - Si usa: **Versión "^2.2.2"**, debe establecer explícitamente la propiedad "allowFunctionEvaluation" de "JsonTree" a "false" para mitigar completamente esta vulnerabilidad. - En las versiones anteriores a "3.0.0 incluyéndola"**, "allowFunctionEvaluation" ya está configurado por defecto a "false", por lo que no es necesario realizar ningún otro paso.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-07-15 CVE Reserved
2022-08-15 CVE Published
2024-03-07 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CAPEC

References (2)

URL	Tag	Source
https://github.com/oxyno-zeta/react-editable-json-tree/releases/tag/2.2.2	Release Notes

URL	Date	SRC
https://github.com/oxyno-zeta/react-editable-json-tree/security/advisories/GHSA-j3rv-w43q-f9x2	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
React Editable Json Tree Project Search vendor "React Editable Json Tree Project"		React Editable Json Tree Search vendor "React Editable Json Tree Project" for product "React Editable Json Tree"				< 2.2.2 Search vendor "React Editable Json Tree Project" for product "React Editable Json Tree" and version " < 2.2.2"		node.js		Affected