PT-2022-23110 · Unknown · React-Editable-Json-Tree

Oxyno-Zeta + 1 · Published 2022-08-15 · Updated 2022-08-18 · CVE-2022-36010

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions react-editable-json-tree versions <2.2.2 react-editable-json-tree version 2.2.2 and later with allowFunctionEvaluation prop set to true react-editable-json-tree versions prior to 3.0.0 with allowFunctionEvaluation prop set to true

Description The library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. This is done using Javascript's eval function to execute strings that begin with "function" as Javascript, which can allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. Users who have defined a custom onSubmitValueParser callback prop on the JsonTree component should be unaffected.

In version 2.2.2, the library switched from using eval to using Function to construct anonymous functions, which is better for security reasons: arbitrary code should not be able to execute immediately, and functions are created without local closures, so they only have access to the global scope.

Recommendations

• For versions <2.2.2, upgrade to version 2.2.2 or later as soon as possible.
• For version 2.2.2 and later with allowFunctionEvaluation prop set to true, explicitly set JsonTree's allowFunctionEvaluation prop to false to fully mitigate this vulnerability.
• For versions >=3.0.0, no further steps are necessary since allowFunctionEvaluation is already set to false by default.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2022-36010

GHSA-J3RV-W43Q-F9X2

Affected Products

React-Editable-Json-Tree

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36010.json · Exploit
• 🔥 https://github.com/oxyno-zeta/react-editable-json-tree/security/advisories/GHSA-j3rv-w43q-f9x2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36010 · Security Note
• https://osv.dev/vulnerability/GHSA-j3rv-w43q-f9x2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36010 · Vendor Advisory
• https://github.com/oxyno-zeta/react-editable-json-tree/releases/tag/2.2.2 · Note
• https://github.com/oxyno-zeta/react-editable-json-tree · Note
• https://t.me/cibsecurity/48171 · Telegram Post