Description

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-08T03:17:19.433Z",
  "pubdate": "2026-09-08T03:17:19.433Z",
  "executiveSummary": "A vulnerability classified as improper access control exists in the java-json-tools json-patch library, specifically within versions up to 1.13. The vulnerability originates from insecure handling of copy and move operations, which can be leveraged by remote attackers to perform unauthorized data manipulation or access sensitive JSON structures.\nThe flaw resides in the 'CopyOperation.apply' and 'MoveOperation.apply' functions located in 'src/main/java/com/github/fge/jsonpatch/CopyOperation.java'. By manipulating JSON patch operations, an attacker can bypass intended access restrictions, potentially leading to unauthorized data modification, disclosure, or integrity compromise of the JSON document being processed.\nThis vulnerability is remotely exploitable, and the availability of public exploit material increases the risk of successful exploitation by unauthorized actors. The project maintainers have been notified of this issue, but no official patch has been provided at this time. Organizations relying on this library should treat this as a high-priority risk and implement compensating controls immediately.",
  "technicalDetails": "The vulnerability is fundamentally rooted in the lack of sufficient input validation and context-aware access control mechanisms within the 'CopyOperation' and 'MoveOperation' implementations in the java-json-tools json-patch library. These operations are responsible for duplicating or relocating elements within a JSON document based on provided pointers.\nWhen a JSON patch request is processed, the 'apply' methods within 'CopyOperation.java' fail to adequately verify if the source and destination paths conform to the expected security policy or if they cross defined trust boundaries. An attacker can craft a malicious JSON patch document containing carefully constructed 'copy' or 'move' operations that target restricted or unintended paths within the target JSON object.\nThe attack flow proceeds as follows: An attacker sends a specifically crafted JSON patch request to an application utilizing the vulnerable library. The application invokes the library to apply these operations to a target JSON document. During the execution of 'CopyOperation.apply' or 'MoveOperation.apply', the library performs the operation without checking if the source pointer contains data that should remain inaccessible, or if the destination pointer allows for unauthorized injection into protected areas of the document structure.\nBecause the logic fails to enforce constraints on the movement or copying of nodes, an attacker can effectively perform arbitrary JSON structure manipulation. This may involve copying sensitive information to a location accessible by the attacker or moving data to overwrite existing, legitimate nodes, resulting in a denial-of-service, data corruption, or information exposure.\nAffected versions include all iterations up to and including 1.13. The flaw is exploitable remotely, requiring no prior authentication if the vulnerable library is exposed to untrusted input. The technical impact is significant as it allows for bypasses of business logic that relies on the integrity of JSON operations, and the existence of public exploit code lowers the barrier for attackers to weaponize this flaw against exposed systems."
}