CVE-2024-21534 Overview
CVE-2024-21534 is a critical Remote Code Execution (RCE) vulnerability affecting all versions of the jsonpath-plus npm package. The vulnerability exists due to improper input sanitization, allowing attackers to execute arbitrary code on systems running Node.js applications that utilize this popular JSON path evaluation library. The flaw stems from the unsafe default usage of the vm module in Node.js, which can be exploited to escape the sandbox and execute malicious code on the host system.
Multiple fix attempts were made in versions 10.0.0 through 10.1.0, but researchers discovered that the vulnerability could still be exploited using alternative payloads, making this a persistent security concern for applications depending on jsonpath-plus.
Critical Impact
This vulnerability enables unauthenticated remote attackers to achieve full system compromise through arbitrary code execution on any Node.js application using jsonpath-plus for JSON path evaluation.
Affected Products
- jsonpath-plus (all versions)
- Applications and services utilizing jsonpath-plus for JSON path queries
- WebJars npm packages including org.webjars.npm:jsonpath-plus
Discovery Timeline
- 2024-10-11 - CVE-2024-21534 published to NVD
- 2024-11-18 - Last updated in NVD database
Technical Details for CVE-2024-21534
Vulnerability Analysis
This Remote Code Execution vulnerability exists within the jsonpath-plus library's core evaluation mechanism. The package uses Node.js's vm module to evaluate JSONPath expressions, but fails to properly sanitize user-controlled input before evaluation. This creates a critical code injection vector where malicious JSONPath expressions can break out of the vm sandbox and execute arbitrary JavaScript code on the underlying system.
The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection), which describes flaws where software constructs code segments using externally-influenced input without proper neutralization of special elements. In this case, attackers can craft specially-formed JSONPath queries that escape the vm context and gain access to Node.js runtime primitives.
Root Cause
The root cause of CVE-2024-21534 lies in the insecure implementation of the JavaScript vm module for expression evaluation. The vm module in Node.js is not designed to be a security boundary and is explicitly documented as not providing a secure sandbox. When jsonpath-plus uses this module to evaluate user-provided JSONPath expressions without rigorous input sanitization, attackers can leverage well-known vm escape techniques to access the process object and execute arbitrary system commands.
Despite remediation attempts in versions 10.0.0 through 10.1.0, the fix implementations were incomplete, allowing researchers to discover alternative payload structures that bypassed the security controls.
Attack Vector
The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by supplying a maliciously crafted JSONPath expression to any application endpoint that processes user-provided JSONPath queries using the jsonpath-plus library.
The exploitation process involves:
- Identifying an application that accepts user-controlled JSONPath expressions
- Crafting a payload that escapes the vm sandbox context
- Accessing Node.js constructor chains to reach the process object
- Executing arbitrary system commands through child_process or similar modules
The vulnerability can be triggered by sending a specially crafted JSONPath expression to any application that passes untrusted input to the jsonpath-plus evaluation function. As documented in the GitHub Issue Discussion, multiple bypass techniques exist that circumvent initial fix attempts, making it essential to evaluate whether jsonpath-plus should be used with any untrusted input.
Detection Methods for CVE-2024-21534
Indicators of Compromise
- Unusual JSONPath query patterns containing JavaScript constructor chains or prototype references
- Application logs showing errors related to vm context escapes or sandbox violations
- Unexpected child process spawning from Node.js applications using jsonpath-plus
- Network traffic containing encoded or obfuscated JSONPath expressions with suspicious payloads
Detection Strategies
- Monitor application logs for JSONPath expressions containing suspicious patterns like constructor, __proto__, or process
- Implement Web Application Firewall (WAF) rules to detect and block common vm escape payload patterns
- Deploy runtime application self-protection (RASP) to detect code injection attempts
- Use static code analysis tools to identify jsonpath-plus usage with untrusted input
Monitoring Recommendations
- Enable verbose logging for all jsonpath-plus function calls and their input parameters
- Set up alerts for any process execution anomalies in Node.js application containers
- Monitor npm audit reports for vulnerable jsonpath-plus versions in CI/CD pipelines
- Implement dependency scanning to track all instances of jsonpath-plus across the organization
How to Mitigate CVE-2024-21534
Immediate Actions Required
- Audit all applications for jsonpath-plus usage and identify instances processing untrusted input
- Implement strict input validation and allowlisting for any JSONPath expressions accepted from users
- Consider replacing jsonpath-plus with alternative JSONPath libraries that do not use vm-based evaluation
- Deploy network-level controls to limit exposure of affected applications while remediation is in progress
Patch Information
As of the last update, the vulnerability persists across all versions of jsonpath-plus, including versions 10.0.0 through 10.1.0 which contained incomplete fixes. The GitHub Version Comparison shows the attempted remediation efforts, while the GitHub Issue Discussion documents the bypass techniques that render these fixes ineffective.
Organizations should monitor the jsonpath-plus repository for future security releases and consider the following resources for vulnerability details:
Workarounds
- Avoid passing user-controlled input directly to jsonpath-plus evaluation functions
- Implement a strict allowlist of permitted JSONPath patterns and reject all expressions not matching the allowlist
- Run Node.js applications using jsonpath-plus in isolated containers with minimal privileges
- Use alternative JSONPath libraries such as jsonpath or json-query that do not rely on vm-based evaluation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
