Following The JSON Path: A Road Paved in RCE

The talk begins with a bug bounty target: an Express API that takes a JSON object and a JSON path, then evaluates filter expressions on the server. Nick Copi asks whether those expressions can be abused to run arbitrary JavaScript, and walks through how JSON path queries are parsed into syntax trees and evaluated.

He examines two popular npm libraries. The older one used a restricted static evaluator, but its checks on function constructors could be sidestepped with prototype tricks to reach code execution. The newer one ran expressions in Node's VM module, which is not a security boundary, so default settings were exploitable too. To gauge reach, he scraped npm and GitHub dependents and looked for downstream products that passed untrusted paths into these libraries.

The search surfaced remote code execution in a badge-generating service, fixed quickly with a CVE, and in a mock API server that stayed unpatched after the project was abandoned. Other findings included XSS in undisclosed applications and a client-side XSS in CyberChef that escaped its web worker, also unfixed. The talk also covers a later critical CVE in the newer library and a bypass of its fix through array-to-string coercion. The takeaways: treat libraries as in scope, avoid evaluating untrusted paths, and never rely on VM-based sandboxes.