PT-2021-8000 · Npm · Json-Pointer

Alessio Della Libera · Published 2021-10-31 · Updated 2025-03-05 · CVE-2021-23807

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions jsonpointer versions prior to 5.0.0

Description A type confusion issue in the jsonpointer package can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. This can potentially allow a remote attacker to execute arbitrary code. The issue is related to errors in data type conversion.

Recommendations For versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the jsonpointer package until a patch is applied. Avoid using the jsonpointer package with array components in pointer paths until the issue is resolved.

Exploit

Fix

Prototype Pollution

Type Confusion

Weakness Enumeration

CWE-1321

CWE-843

Related Identifiers

BDU:2024-01733

CVE-2021-23807

GHSA-282F-QQGM-C34Q

OESA-2022-1755

SNYK-JAVA-ORGWEBJARSNPM-1910273

SNYK-JS-JSONPOINTER-1577288

Affected Products

Json-Pointer

References · 16

• 🔥 https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273 · Exploit
• https://github.com/janl/node-jsonpointer/pull/51 · Patch
• https://github.com/janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4 · Patch
• https://osv.dev/vulnerability/OESA-2022-1755 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01733 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23807 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-282f-qqgm-c34q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23807 · Security Note
• https://github.com/janl/node-jsonpointer · Note
• https://t.me/cibsecurity/31760 · Telegram Post
• https://t.me/cvenotify/113569 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1755 · Note
• https://access.redhat.com/security/cve/CVE-2021-23807 · Note