FKIE_CVE-2024-27307

Vulnerability from fkie_nvd - Published: 2024-03-06 20:15 - Updated: 2026-06-17 07:19
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
References
security-advisories@github.comhttps://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1Patch
security-advisories@github.comhttps://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00cPatch
security-advisories@github.comhttps://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2Patch
security-advisories@github.comhttps://github.com/jsonata-js/jsonata/releases/tag/v2.0.4Product, Release Notes
security-advisories@github.comhttps://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8Technical Description, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00cPatch
af854a3a-2127-422b-91ae-364da2661108https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4Product, Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8Technical Description, Vendor Advisory
Impacted products
Vendor Product Version
jsonata jsonata *
jsonata jsonata *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jsonata",
          "vendor": "jsonata-js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.0, \u003c 1.8.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:jsonatajs:jsonata:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "jsonata",
          "vendor": "jsonatajs",
          "versions": [
            {
              "lessThan": "1.8.7",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jsonata:jsonata:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B99EE804-545C-484E-99C5-86D2B146668D",
              "versionEndExcluding": "1.8.7",
              "versionStartIncluding": "1.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:jsonata:jsonata:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17791F8A-DC1A-4A1E-A4B8-FA5D3BD1B218",
              "versionEndExcluding": "2.0.4",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually."
    },
    {
      "lang": "es",
      "value": "JSONata es un lenguaje de consulta y transformaci\u00f3n JSON. A partir de la versi\u00f3n 1.4.0 y anteriores a las versiones 1.8.7 y 2.0.4, una expresi\u00f3n maliciosa puede utilizar el operador de transformaci\u00f3n para anular propiedades en el constructor y prototipo del `Objeto`. Esto puede provocar denegaci\u00f3n de servicio, ejecuci\u00f3n remota de c\u00f3digo u otro comportamiento inesperado en aplicaciones que eval\u00faan expresiones JSONata proporcionadas por el usuario. Este problema se solucion\u00f3 en las versiones 1.8.7 y 2.0.4 de JSONata. Las aplicaciones que eval\u00faan expresiones proporcionadas por el usuario deben actualizarse lo antes posible para evitar la explotaci\u00f3n. Como soluci\u00f3n alternativa, se puede aplicar el parche manualmente."
    }
  ],
  "id": "CVE-2024-27307",
  "lastModified": "2026-06-17T07:19:37.060",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27307",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-03-07T20:11:04.720141Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-03-06T20:15:47.537",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Technical Description",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.