CVE-2025-1302 in jsonpath-plus
Summary
by MITRE • 02/15/2025
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.
**Note:**
This is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/15/2025
The vulnerability identified as CVE-2025-1302 affects the jsonpath-plus package, specifically versions prior to 10.3.0, and represents a critical remote code execution flaw that stems from inadequate input sanitization practices. This security weakness allows attackers to execute arbitrary code on affected systems by exploiting the unsafe default usage of eval='safe' mode within the package's functionality. The vulnerability manifests when the package processes user-supplied input through its evaluation mechanisms without proper validation or sanitization, creating a pathway for malicious code injection that can compromise the entire system. The flaw operates at the core of the package's evaluation engine where it defaults to a supposedly safe evaluation mode that still permits code execution through carefully crafted inputs.
The technical implementation of this vulnerability involves the package's handling of JSONPath expressions that contain executable code within their evaluation context. When the eval='safe' parameter is used, the package is supposed to provide protection against code injection attacks, but the implementation contains a critical oversight that allows attackers to bypass these safeguards. The vulnerability is particularly dangerous because it leverages the legitimate functionality of the package while introducing an unintended execution path that can be exploited by malicious actors. This flaw directly relates to CWE-94, which describes the weakness of allowing arbitrary code execution through improper input validation and unsafe evaluation mechanisms. The attack vector typically involves sending specially crafted JSONPath expressions that contain malicious JavaScript code, which then gets executed within the context of the application using the vulnerable package.
The operational impact of CVE-2025-1302 extends far beyond simple data compromise, as successful exploitation can lead to complete system takeover and persistent access for attackers. An attacker who successfully exploits this vulnerability can execute commands with the privileges of the affected application, potentially leading to data theft, system compromise, or further network infiltration. The vulnerability affects any system that utilizes the jsonpath-plus package with eval='safe' mode enabled, making it particularly concerning for web applications, APIs, and services that process user input through JSONPath expressions. The risk is amplified when the package is used in server-side environments where the execution context has broad system access, and the vulnerability can be exploited through various attack surfaces including web forms, API endpoints, or any interface that accepts JSONPath queries. This vulnerability aligns with ATT&CK technique T1059.007, which covers the execution of code through scripting languages, and represents a critical escalation path for attackers seeking to gain persistent access to target systems.
Mitigation strategies for CVE-2025-1302 primarily focus on immediate remediation through package version updates to 10.3.0 or later, which contains the necessary fixes for the input sanitization issues. Organizations should conduct comprehensive inventory assessments to identify all systems utilizing vulnerable versions of the jsonpath-plus package and prioritize immediate patching of affected environments. Additionally, implementing proper input validation and sanitization measures at the application level can provide defense-in-depth protection, even if the underlying package vulnerability remains unpatched temporarily. Security teams should also consider implementing network monitoring and intrusion detection systems to identify potential exploitation attempts, as the attack patterns for this vulnerability often involve sending malformed JSONPath expressions that may trigger network-based detection mechanisms. The vulnerability serves as a reminder of the importance of thorough security reviews and the dangers of incomplete fixes, as noted by the relationship to CVE-2024-21534, which indicates that the initial remediation effort was insufficient to fully address the underlying security issues. Organizations should also consider implementing application whitelisting or sandboxing techniques to limit the potential impact of any remaining vulnerabilities and establish proper security hygiene practices for dependency management and vulnerability assessment.