Summary
JQ::Lite for Perl can execute Perl code embedded in regular-expression patterns because query expressions are compiled as source text with string evaluation. An attacker who can supply a query, or influence text inserted into a query pattern, may execute arbitrary Perl code in the calling process.
JQ::Lite for Perl can execute Perl code embedded in regular-expression patterns because query expressions are compiled as source text with string evaluation. An attacker who can supply a query, or influence text inserted into a query pattern, may execute arbitrary Perl code in the calling process.
Affected context
The vulnerability occurs in JQ::Lite query operations that evaluate regular-expression patterns supplied to test(), match(), or the corresponding match and =~ conditions of select(). It is relevant when an untrusted user can provide a query or control text that an application incorporates into one of these patterns, allowing the resulting expression to be compiled as Perl source.
The vulnerability occurs in JQ::Lite query operations that evaluate regular-expression patterns supplied to test(), match(), or the corresponding match and =~ conditions of select(). It is relevant when an untrusted user can provide a query or control text that an application incorporates into one of these patterns, allowing the resulting expression to be compiled as Perl source.
Exploit preconditions
- Attack surface: JQ::Lite query processing and regular-expression evaluation
- Required access: Ability to supply a query or influence text inserted into a query pattern
- Trigger point: Evaluation of a pattern by
test(),match(), or matching conditions inselect() - Why exploitation is possible: Pattern text is embedded in a Perl
qrliteral and compiled through string evaluation, allowing embedded code blocks to execute in the caller's process
- Attack surface: JQ::Lite query processing and regular-expression evaluation
- Required access: Ability to supply a query or influence text inserted into a query pattern
- Trigger point: Evaluation of a pattern by
test(),match(), or matching conditions inselect() - Why exploitation is possible: Pattern text is embedded in a Perl
qrliteral and compiled through string evaluation, allowing embedded code blocks to execute in the caller's process
Why this happens
The underlying bug is the treatment of attacker-influenced regular-expression text as executable Perl source. JQ::Lite constructs a qr expression as a string and compiles it with string evaluation, so regular-expression syntax can contain executable Perl behavior rather than remaining data-only pattern content. This maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code, because input is incorporated into dynamically evaluated source without reliably separating data from code.
The underlying bug is the treatment of attacker-influenced regular-expression text as executable Perl source. JQ::Lite constructs a qr expression as a string and compiles it with string evaluation, so regular-expression syntax can contain executable Perl behavior rather than remaining data-only pattern content. This maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code, because input is incorporated into dynamically evaluated source without reliably separating data from code.
Potential impact
- Arbitrary Perl code could execute in the calling process
- Application data could be read, modified, or deleted
- Credentials and environment secrets may be exposed
- The application process could be compromised or disrupted
- An attacker could use the process's privileges to affect connected systems
- Arbitrary Perl code could execute in the calling process
- Application data could be read, modified, or deleted
- Credentials and environment secrets may be exposed
- The application process could be compromised or disrupted
- An attacker could use the process's privileges to affect connected systems
General mitigation guidance
Mitigation generally focuses on preventing untrusted input from becoming executable regular-expression source.
Common defensive patterns include:
- Avoiding dynamic source evaluation for query and pattern construction
- Treating user-controlled patterns as data and applying a safe, non-evaluating matching interface
- Restricting query capabilities through an allowlisted grammar or predefined operations
- Separating user-supplied values from query structure and escaping them according to the intended matching semantics
- Running the calling process with least privilege and limiting access to sensitive files, credentials, and services
- Applying resource and execution boundaries so a compromised query process has limited reach
Mitigation generally focuses on preventing untrusted input from becoming executable regular-expression source.
Common defensive patterns include:
- Avoiding dynamic source evaluation for query and pattern construction
- Treating user-controlled patterns as data and applying a safe, non-evaluating matching interface
- Restricting query capabilities through an allowlisted grammar or predefined operations
- Separating user-supplied values from query structure and escaping them according to the intended matching semantics
- Running the calling process with least privilege and limiting access to sensitive files, credentials, and services
- Applying resource and execution boundaries so a compromised query process has limited reach
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying string evaluation used to construct regular expressions or query expressions
- Code review checks for user-controlled data flowing into
qr,eval, dynamic query compilation, or matching APIs - Tests that verify query inputs remain data and cannot alter expression structure
- Dependency and policy checks for libraries that dynamically evaluate attacker-influenced patterns
- Runtime monitoring for unexpected child processes, filesystem access, or sensitive API usage by Perl application workers
Automated security review tools may help identify dynamic evaluation and tainted-input flows, but findings should be validated against the application's query construction logic.
Organizations can look for this issue through:
- Static analysis rules identifying string evaluation used to construct regular expressions or query expressions
- Code review checks for user-controlled data flowing into
qr,eval, dynamic query compilation, or matching APIs - Tests that verify query inputs remain data and cannot alter expression structure
- Dependency and policy checks for libraries that dynamically evaluate attacker-influenced patterns
- Runtime monitoring for unexpected child processes, filesystem access, or sensitive API usage by Perl application workers
Automated security review tools may help identify dynamic evaluation and tainted-input flows, but findings should be validated against the application's query construction logic.
