CVE-2022-46175
JSON5 Prototype Pollution Vulnerability
Description
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.
INFO
Published Date :
Dec. 24, 2022, 4:15 a.m.
Last Modified :
Nov. 21, 2024, 7:30 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.8
Public PoC/Exploit Available at Github
CVE-2022-46175 has a 7 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-46175.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
A centralized repository of standalone security patches for open source libraries.
appsec backport cve devsecops fix hotfix open-source patch protection remediation seal security update upgrade vulnerability
Checks for vulnerabilities in NPM packages and report EPSS Scores for CVEs
epss cisa-kev cve cvss cwe npm vulnerabilities
JavaScript
None
None
Reproduction for CVE-2022-46175
JavaScript Vue TypeScript SCSS HTML
An Obsidian plugin to display the frontmatter section as a fully expanded table.
obsidian obsidian-plugin
TypeScript JavaScript CSS Just
Repository of Bug-Bounty Writeups
bugbounty fuzzing penetration-testing security-tools
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-46175 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-46175 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://github.com/json5/json5/issues/199 Added Reference https://github.com/json5/json5/issues/295 Added Reference https://github.com/json5/json5/pull/298 Added Reference https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h Added Reference https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ -
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by [email protected]
Nov. 26, 2023
Action Type Old Value New Value Added Reference GitHub, Inc. https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html [No types assigned] -
CVE Modified by [email protected]
Nov. 07, 2023
Action Type Old Value New Value Added Reference GitHub, Inc. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ [No types assigned] Removed Reference GitHub, Inc. https://lists.fedoraproject.org/archives/list/[email protected]/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ -
Modified Analysis by [email protected]
Feb. 28, 2023
Action Type Old Value New Value Changed Reference Type https://lists.fedoraproject.org/archives/list/[email protected]/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ No Types Assigned https://lists.fedoraproject.org/archives/list/[email protected]/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ Mailing List, Third Party Advisory Added CPE Configuration OR *cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* -
CVE Modified by [email protected]
Jan. 30, 2023
Action Type Old Value New Value Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/ [No Types Assigned] -
Modified Analysis by [email protected]
Jan. 20, 2023
Action Type Old Value New Value Changed Reference Type https://github.com/json5/json5/pull/298 No Types Assigned https://github.com/json5/json5/pull/298 Patch, Third Party Advisory Changed CPE Configuration OR *cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.2.2 OR *cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* versions up to (excluding) 1.0.2 *cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* versions from (including) 2.0.0 up to (excluding) 2.2.2 -
CVE Modified by [email protected]
Jan. 03, 2023
Action Type Old Value New Value Changed Description JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including version `2.2.1` does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later. JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later. Added Reference https://github.com/json5/json5/pull/298 [No Types Assigned] -
Initial Analysis by [email protected]
Dec. 30, 2022
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://github.com/json5/json5/issues/199 No Types Assigned https://github.com/json5/json5/issues/199 Issue Tracking, Patch, Third Party Advisory Changed Reference Type https://github.com/json5/json5/issues/295 No Types Assigned https://github.com/json5/json5/issues/295 Issue Tracking, Third Party Advisory Changed Reference Type https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h No Types Assigned https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h Exploit, Third Party Advisory Added CPE Configuration OR *cpe:2.3:a:json5:json5:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.2.2
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-46175 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-46175
weaknesses.
Exploit Prediction
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.
42.41 }} 1.77%
score
0.97278
percentile