CVE-2024-38993

Vulnerability

CVE-2024-38993 describes a prototype pollution vulnerability in jsonic-next version 2.12.1, a JavaScript library providing a lenient JSON parser from the jsonicjs project [1][2]. The flaw resides in functions such as empty, util.clone, util.prop, util.deep, and make, which fail to sanitize input objects containing the __proto__ property [3]. This allows an attacker to inject arbitrary properties into the global Object.prototype.

Exploitation

An attacker can trigger the vulnerability by passing a crafted JavaScript object (e.g., {"__proto__": {"test": 123}}) to any of the affected functions [3]. The proof-of-concept code demonstrates that calling lib.empty(JSON.parse('{"__proto__": {"test": 123}}')) pollutes the prototype of all objects, as evidenced by the __proto__.test property appearing on a separate victim object [3]. No special network position or authentication is required; the attack vector is local to the client-side application or server-side Node.js environment where the library is used.

Impact

Successful exploitation enables the attacker to corrupt the Object.prototype of the JavaScript runtime, which can lead to arbitrary code execution, denial of service, or cross-site scripting (XSS), depending on how the polluted properties are subsequently used by the application [1][3]. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), reflecting the high severity and ease of exploitation [3].

Mitigation

As of publication, the vendor has not released a patched version; the advisory recommends avoiding the use of the affected functions with untrusted input or applying input sanitization to block __proto__ keys [1][3]. Users should monitor the jsonicjs/jsonic repository for an update and consider using alternative JSON parsing libraries that are not susceptible to prototype pollution.