PT-2020-19786 · Jsen · Jsen

Published 2020-11-23 · Updated 2022-02-10 · CVE-2020-7777

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsen versions all

Description This issue affects the jsen package, allowing an attacker to run arbitrary JavaScript code on the victim machine if they can control the schema file. The required field of the schema is not properly sanitized, and the resulting string is passed to a Function.apply(), leading to Arbitrary Code Execution. There is no mention of the risks of untrusted schema files in the module description and README file.

Recommendations As a temporary workaround, consider disabling the use of untrusted schema files until a patch is available. Restrict access to the Function.apply() function to minimize the risk of exploitation. Avoid using the required field in the schema definition until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-7777

GHSA-VM64-CFQX-3698

Affected Products

Jsen

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-JSEN-1014670 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7777 · Security Note
• https://osv.dev/vulnerability/GHSA-vm64-cfqx-3698 · Vendor Advisory
• https://github.com/bugventure/jsen/blob/master/lib/jsen.js#L875 · Note
• https://github.com/bugventure/jsen/blob/master/lib/jsen.js%23L875 · Note
• https://security.snyk.io/vuln/SNYK-JS-JSEN-1014670 · Note
• https://t.me/cibsecurity/16696 · Telegram Post