CVE-2022-42743 in deep-parse-json
Summary
by MITRE • 11/04/2022
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/04/2022
The vulnerability identified as CVE-2022-42743 affects the deep-parse-json library version 1.0.2 and represents a critical security flaw that enables prototype pollution attacks. This vulnerability arises from inadequate input validation mechanisms within the library's JSON parsing functionality, specifically failing to sanitize or restrict the use of special property names that can manipulate object prototypes. The issue stems from the library's inability to properly validate incoming JSON keys, allowing malicious actors to inject properties with names that can alter the prototype chain of objects being parsed.
The technical exploitation of this vulnerability occurs through the manipulation of the '_proto_' property within JSON data structures. When the deep-parse-json library processes JSON input containing this property, it fails to implement proper validation checks that would normally prevent modification of prototype properties. This allows attackers to inject malicious code or manipulate object behavior by altering the prototype chain of objects within the application's memory space. The vulnerability is particularly dangerous because prototype pollution can lead to various downstream security issues including code execution, denial of service, and data manipulation attacks.
From an operational impact perspective, this vulnerability poses significant risks to applications that rely on deep-parse-json for processing external JSON data. The prototype pollution can be leveraged to modify the behavior of core JavaScript objects, potentially enabling attackers to bypass security controls, manipulate application logic, or gain unauthorized access to sensitive data. The vulnerability affects the integrity and confidentiality of applications since it allows attackers to alter object properties that may control application flow or data handling mechanisms. This type of vulnerability can be particularly devastating in environments where the library processes user-provided data without additional sanitization layers.
The security implications of CVE-2022-42743 align with CWE-471, which describes the weakness of "Modification of Assumed-Immutable Data" and is categorized under the broader ATT&CK technique of T1059.1001 for "Command and Scripting Interpreter: JavaScript". Organizations using this vulnerable library should immediately implement mitigation strategies including updating to patched versions, implementing input validation at multiple layers, and employing strict property name validation for JSON parsing operations. The vulnerability demonstrates the critical importance of proper input sanitization and the potential for seemingly benign parsing libraries to introduce severe security risks into applications. Security teams should also consider implementing runtime monitoring to detect anomalous prototype modifications and establish comprehensive testing procedures for JSON processing components to prevent similar vulnerabilities from being introduced in the future.