Arbitrary Code Execution

An attacker can control the schema file used by the jsen package. By injecting malicious JavaScript code into the 'required' field of the schema, the attacker can cause arbitrary JavaScript code to be executed on the victim machine when the schema is processed. The module description and README do not warn about the risks of untrusted schema files, making this attack vector more plausible [ref_id=1]. The resulting string is then passed to Function.apply(), leading to code execution [ref_id=2].

The vulnerability lies within the jsen package, specifically in how it handles the 'required' field within a schema definition. The code constructs a string based on this field, which is then passed to `Function.apply()`, enabling arbitrary code execution [ref_id=1]. The affected code path is referenced at `lib/jsen.js#L875` [ref_id=1].

The advisory states that there is no fixed version for jsen [ref_id=2]. Therefore, no patch is available to address this vulnerability. Users are advised to avoid using untrusted schema files with the jsen package.

const jsen = require('jsen');

let schema = JSON.parse( { "type": "object", "properties": { "username": { "type": "string" } }, "required": ["\"+process.mainModule.require(\'child_process\').execSync(\'touch malicious\')+\"" ] }); const validate = jsen(schema); validate({});