Code Injection in JQ::Lite Perl Module

Executive Summary

JQ::Lite versions before 2.51 for Perl allow arbitrary code execution due to improper handling of regular expressions. The vulnerability occurs because Perl code embedded in a query's regex pattern is executed via string eval without proper restrictions. Attackers can inject malicious code through queries or application-provided text, leading to arbitrary Perl code execution in the vulnerable process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Perl applications using JQ::Lite versions before 2.51 for embedded code execution in regular expressions. Check for patterns using (?{ ... }) blocks in user-supplied queries or inputs processed by test(), match(), or select(). Review application logs for unexpected Perl code execution or system commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary Perl code on systems using vulnerable versions of JQ::Lite. This could lead to unauthorized data access, system compromise, or further exploitation of the affected application or server. Applications processing untrusted input with JQ::Lite are particularly at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or data exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade JQ::Lite to version 2.51 or later. Replace eval-based regex compilation with safe alternatives like the provided patch that uses qr/(?$modifiers:$pattern)/. Audit and sanitize all user inputs used in regex patterns to prevent code injection.

Useful 0 Not Useful 0