PT-2022-26533 · Unknown · Deep-Parse-Json

Carlos Bello · Published 2022-11-03 · Updated 2025-04-24 · CVE-2022-42743

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions deep-parse-json version 1.0.2

Description The issue allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the proto property to be edited.

Recommendations For deep-parse-json version 1.0.2, consider validating incoming JSON keys to prevent the proto property from being edited as a temporary workaround until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-42743

GHSA-FF9J-PWXG-Q5P2

Affected Products

Deep-Parse-Json

References · 9

• 🔥 https://fluidattacks.com/advisories/buuren · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42743 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42743 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ff9j-pwxg-q5p2 · Vendor Advisory
• https://github.com/sibu-github/deep-parse-json · Note
• https://github.com/sibu-github/deep-parse-json/issues/6 · Note
• https://t.me/cibsecurity/52536 · Telegram Post
• https://twitter.com/fluidattacks/status/1915531948849512815 · Twitter Post
• https://twitter.com/fluidattacks/status/1915531948832735379 · Twitter Post