Cross-Site Scripting in jsondiffpatch via Unescaped Delta Index

Executive Summary

This is a cross-site scripting (XSS) vulnerability in the jsondiffpatch library before version 0.7.7. It occurs when an attacker provides an unescaped array-move destination index in a delta. When processed by HTML formatters like formatters.html.format() or formatters.annotated.format(), this can inject malicious scripts that execute in the application's origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses jsondiffpatch versions before 0.7.7. Inspect package.json or run commands like npm list jsondiffpatch or yarn list jsondiffpatch to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable version of jsondiffpatch (0.7.6 or earlier) and render formatter output as HTML from untrusted data, attackers could execute malicious scripts in your application's context. This could lead to data theft, session hijacking, or other malicious activities depending on the application's functionality.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade jsondiffpatch to version 0.7.7 or later. Avoid rendering formatter output from untrusted data as HTML. Review applications using jsondiffpatch to ensure proper input sanitization.

Useful 0 Not Useful 0