CVE-2024-21534

What it actually does

The vulnerability is a remote code execution flaw in jsonpath-plus caused by unsafe evaluation of JSONPath expressions through Node.js vm behavior and insufficient sanitization of attacker-controlled input. If an application passes untrusted JSONPath expressions to jsonpath-plus, crafted expressions can escape the intended sandbox and execute arbitrary JavaScript in the Node.js process. Successful exploitation can allow command execution with the privileges of the affected application, leading to confidentiality, integrity, and availability compromise. Earlier attempted fixes in jsonpath-plus versions 10.0.0 through 10.1.0 were reported as bypassable with alternate payloads, so relying on those versions alone is not sufficient without confirming the final patched code is present.

Why it matters to the business

Applications, APIs, automation services, data-processing pipelines, or integration platforms that accept user-supplied JSONPath filters may be exposed to full server compromise. An attacker could steal secrets, access backend data, modify processing logic, deploy malware, or disrupt service availability. The CVSS score is critical at 9.8 because exploitation can be remote, unauthenticated, low-complexity, and requires no user interaction when vulnerable JSONPath input is reachable over a network. Although it is not currently listed in CISA KEV and no ransomware use is indicated, the issue has been public for a long period and affects a reusable library, increasing the likelihood that vulnerable copies remain embedded in downstream products or bundled dependencies.

How an attack unfolds

An attacker first identifies an application feature that accepts or indirectly constructs JSONPath expressions using jsonpath-plus, such as query, filtering, transformation, routing, or rules-evaluation functionality. The attacker supplies a malicious JSONPath expression designed to reach JavaScript execution primitives rather than only select JSON data. Because vulnerable versions rely on unsafe vm usage and incomplete input restrictions, the expression can break out of the intended evaluation context and invoke Node.js capabilities. From there, the attacker attempts to load sensitive runtime objects or modules, execute operating-system commands, read environment variables, retrieve application secrets, write files, or open outbound network connections. If successful, the attacker obtains code execution as the application user and may then establish persistence, move laterally using stolen credentials, or tamper with application data and workflows.

How to fix it

Upgrade jsonpath-plus to a release or commit that includes the final fix, not merely the incomplete 10.0.0 through 10.1.0 attempted fixes. For source builds of jsonpath-plus/jsonpath, ensure commit 6b2f1b4c234292c75912b790bf7e2d7339d4ccd3 or a later trusted release containing that commit is present. For Apache NiFi downstream artifacts listed as affected, upgrade org.apache.nifi:nifi-dbcp-base, org.apache.nifi:nifi-jms-processors, org.apache.nifi:nifi-dbcp-service-api, and org.apache.nifi:nifi-dbcp-service-bundle to version 1.23.1 or later. Regenerate lockfiles and container images so transitive vulnerable copies are removed. As defense in depth, do not allow untrusted users to submit arbitrary JSONPath expressions; enforce an allowlist of permitted query patterns; disable script/function evaluation features where possible; isolate evaluation in a hardened sandbox; run Node.js services with least privilege; restrict outbound network access; and protect secrets from application runtime exposure.

How to confirm the fix worked

Confirm dependency resolution with package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls jsonpath-plus, software composition analysis, or container image scanning to ensure no vulnerable jsonpath-plus copy remains. For Maven-based downstream packages, verify that Apache NiFi artifacts resolve to 1.23.1 or later and that shaded or bundled dependencies were rebuilt. Validate the deployed artifact, not only the source repository, because vulnerable JavaScript libraries may be bundled into frontend, backend, container, or vendor packages. Exercise security regression tests using known benign JSONPath expressions and blocked malicious-expression patterns to confirm the application rejects or neutralizes script execution attempts. Review runtime configuration to ensure user-controlled JSONPath input is restricted and that process privileges, filesystem permissions, secret access, and egress controls limit blast radius.

Typical attack path

1. Find an exposed application endpoint or workflow that accepts JSONPath expressions, filters, selectors, or rules from an unauthenticated or low-privileged user.
2. Confirm that the application uses a vulnerable jsonpath-plus dependency or a downstream product bundling the vulnerable library.
3. Submit crafted JSONPath input containing JavaScript escape or sandbox-bypass patterns.
4. Trigger evaluation of the malicious JSONPath expression inside the Node.js process.
5. Execute arbitrary JavaScript or operating-system commands under the privileges of the affected application.
6. Use the compromised process to read secrets, access data, modify application behavior, write files, or initiate outbound connections.
7. Escalate impact through credential theft, persistence, lateral movement, data exfiltration, or service disruption.

How to detect it

To determine whether exploitation already occurred, correlate application access logs, API gateway logs, WAF alerts, reverse-proxy logs, and application debug/error logs for requests containing JSONPath expressions with JavaScript execution or sandbox-escape patterns. Focus on endpoints that accept filtering, querying, selectors, transformation rules, workflow definitions, or JSONPath parameters. Review Node.js application logs for syntax errors, vm exceptions, ReferenceError/TypeError messages involving constructor chains, process objects, module loading, or child process execution. On hosts or containers running affected services, inspect process telemetry for Node.js spawning shells or command-line utilities such as sh, bash, cmd.exe, powershell.exe, curl, wget, nc, python, perl, or busybox. Review EDR, auditd, Sysmon, container runtime, and Kubernetes audit logs for unexpected file creation, secret access, environment-variable dumping, suspicious outbound connections, or new scheduled tasks following suspicious requests. Because public payloads may vary and earlier fixes were bypassed using different payloads, detection should combine request-content matching with behavioral evidence of command execution from the Node.js process.

• constructor.constructor
• constructor['constructor']
• constructor\"constructor\"
• Function("return process")
• Function('return process')
• return process
• process.mainModule
• process.binding
• process.env
• global.process
• require('child_process')
• require("child_process")
• child_process.exec
• child_process.execSync
• child_process.spawn
• child_process.spawnSync
• child_process.fork
• mainModule.require
• module.require
• vm.runInNewContext
• vm.runInContext
• JSONPathError
• jsonpath-plus
• @root.constructor
• @parent.constructor
• @property.constructor
• @path.constructor
• $..[?(
• ?(@.
• /bin/sh
• /bin/bash
• cmd.exe /c
• powershell.exe
• curl http
• wget http
• nc -e

What your security team should do

• Inventory all direct and transitive uses of jsonpath-plus across source repositories, deployed packages, containers, serverless functions, and vendor-bundled applications.
• Prioritize remediation for internet-facing or partner-facing services where users can submit JSONPath, filtering, rule, selector, or transformation expressions.
• Upgrade jsonpath-plus to a version containing commit 6b2f1b4c234292c75912b790bf7e2d7339d4ccd3 or later, and upgrade affected Apache NiFi artifacts to 1.23.1 or later where applicable.
• Do not treat jsonpath-plus 10.0.0 through 10.1.0 as automatically safe; verify that the final bypass-resistant fix is included.
• Add application-level validation to reject dangerous JSONPath script constructs and prohibit arbitrary JSONPath from untrusted users where feasible.
• Search historical application, API gateway, WAF, and reverse-proxy logs for suspicious JSONPath payloads containing JavaScript execution primitives.
• Review affected hosts for evidence of unexpected child processes spawned by Node.js, outbound connections, file writes, or access to secrets around suspicious request times.
• Create SIEM detections for JSONPath requests containing sandbox-escape, constructor chaining, process access, or child_process module references.
• Rebuild and redeploy containers and artifacts after dependency upgrades to remove stale vulnerable copies.
• Apply least-privilege runtime controls, egress filtering, and secret-scoping to reduce impact if expression evaluation is abused.