10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
58.9%
Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue
. To do this, Javascript’s eval
function was used to execute strings that begin with “function” as Javascript. This was an oversight that unfortunately allows arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous.
One important note is that users who have defined a custom onSubmitValueParser
callback prop on the JsonTree
component should be unaffected. This vulnerability exists in the default onSubmitValueParser
prop which calls parse
.
We have decided on a two-pronged approach to patching this vulnerability:
The workaround we have decided on is adding a prop to JsonTree
called allowFunctionEvaluation
. This prop will be set to true
in v2.2.2, so you can upgrade without fear of losing backwards-compatibility.
We have also implemented additional security measures as we know many people may not read the details of this vulnerability, and we want to do the best we can to keep you protected. In v2.2.2, we switched from using eval
to using Function
to construct anonymous functions. This is better than eval
for the following reasons:
Function
constructor explicitly only creates anonymous functionsThis change has brought a slight potential for breaking backwards-compatibility if users for some reason were relying on side-effects of our usage of eval
, but that is beyond intended behavior, so we have decided to go ahead with this change and consider it a non-breaking change.
As mentioned above, there are a few scenarios you must consider:
If you use:
<2.2.2
, you must upgrade as soon as possible.^2.2.2
, you must explicitly set JsonTree
’s allowFunctionEvaluation
prop to false
to fully mitigate this vulnerability.>=3.0.0
, allowFunctionEvaluation
is already set to false
by default, so no further steps are necessary.None.
If you have any questions or comments about this advisory:
CPE | Name | Operator | Version |
---|---|---|---|
react-editable-json-tree | lt | 2.2.2 |