CVE-2020-7712: Joyent Json RCE Vulnerability

CVE-2020-7712 Overview

CVE-2020-7712 is a command injection vulnerability affecting the Joyent json package for Node.js prior to version 10.0.0. The vulnerability exists in the parseLookup function, which improperly handles user-supplied input, allowing attackers with high privileges to inject and execute arbitrary system commands on the underlying operating system.

Critical Impact
Authenticated attackers can exploit this vulnerability to execute arbitrary commands on systems running vulnerable versions of the json package, potentially leading to complete system compromise.

Affected Products

Joyent json (versions prior to 10.0.0)
Oracle Commerce Guided Search 11.3.2
Oracle Financial Services Crime and Compliance Management Studio 8.0.8.2.0 and 8.0.8.3.0
Oracle Financial Services Regulatory Reporting with AgileReporter 8.0.9.6.3
Oracle TimesTen In-Memory Database

Discovery Timeline

August 30, 2020 - CVE-2020-7712 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-7712

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the parseLookup function within the json package, which is a popular command-line tool for working with JSON data in Node.js environments.

The vulnerability allows an attacker with high privileges to craft malicious input that, when processed by the parseLookup function, breaks out of the intended command context and executes arbitrary system commands. This is particularly dangerous in environments where the json package is used to process untrusted or semi-trusted data from external sources.

The impact extends beyond the direct Joyent json package, as several Oracle enterprise products incorporate this vulnerable component, significantly expanding the potential attack surface across financial services and e-commerce platforms.

Root Cause

The root cause of this vulnerability is insufficient input sanitization in the parseLookup function. The function fails to properly validate and escape special characters in user-supplied lookup expressions before passing them to shell execution contexts. This allows shell metacharacters and command separators to be interpreted as commands rather than literal data.

Attack Vector

The vulnerability is exploitable over the network, requiring authenticated access with high privileges. An attacker would craft a malicious JSON lookup expression containing shell metacharacters such as command separators (;, |, &&), backticks for command substitution, or other shell special characters.

When the vulnerable parseLookup function processes this input, the injected commands are executed with the privileges of the process running the json package. This can lead to:

Unauthorized access to sensitive data
Installation of backdoors or malware
Lateral movement within the network
Complete system compromise

The attack does not require user interaction and can be automated once valid authentication credentials are obtained.

Detection Methods for CVE-2020-7712

Indicators of Compromise

Unexpected shell command execution originating from Node.js processes
Anomalous process spawning from applications using the json package
Log entries showing unusual parseLookup function calls with shell metacharacters
Network connections from Node.js processes to unexpected external destinations

Detection Strategies

Monitor application logs for JSON parsing errors or unusual input patterns containing shell metacharacters
Implement runtime application self-protection (RASP) to detect command injection attempts
Use software composition analysis (SCA) tools to identify vulnerable json package versions in your codebase
Deploy intrusion detection systems with signatures for common command injection patterns

Monitoring Recommendations

Enable verbose logging for applications using the json package
Monitor system call activity for unexpected shell spawning from Node.js processes
Set up alerts for package.json or package-lock.json changes that might reintroduce vulnerable versions
Review Apache Zookeeper and Apache Flink deployments for transitive dependencies on this package

How to Mitigate CVE-2020-7712

Immediate Actions Required

Upgrade the json package to version 10.0.0 or later immediately
Audit all applications and dependencies for vulnerable json package versions
Review Oracle product deployments and apply relevant Critical Patch Updates
Implement input validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been addressed in json package version 10.0.0. The fix is available via the GitHub Pull Request. Oracle has released patches for affected products through multiple Critical Patch Updates:

Organizations using Oracle products should consult the relevant CPU advisories for specific patch instructions.

Workarounds

If immediate patching is not possible, implement strict input validation on all data processed by the json package
Restrict network access to systems running vulnerable versions to trusted sources only
Consider sandboxing applications that must use the vulnerable package until patching is complete
Remove or disable unused functionality that relies on the parseLookup function

bash

# Upgrade json package to patched version
npm update json@10.0.0

# Verify installed version
npm list json

# Check for vulnerable versions in project dependencies
npm audit