Executive brief
The json-smart library, a Java tool used for processing JSON data, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, deeply nested JSON file that causes the software to crash by exhausting its memory resources. This can lead to service outages and impact the availability of applications that rely on this library for data processing.
Technical details
The net.minidev:json-smart library fails to implement limits on the nesting depth of JSON arrays and objects. Because the parser uses recursion to handle these structures, an attacker can provide a JSON input with extreme nesting levels to trigger a StackOverflowError. This is a remote, unauthenticated attack vector that results in a complete crash of the JVM process (Denial of Service). The issue is classified as CWE-674 (Uncontrolled Recursion) and was addressed in version 2.4.9, though version 2.4.10 is recommended by maintainers to address subsequent bugs.
Affected products
- net.minidev json-smart < 2.4.9
Timeline
- 2023-03-22: advisory: NVD publication date
- 2023-03-23: disclosed: GitHub Advisory published
- 2023-03-23: patched: Version 2.4.9 released
References
- https://api.github.com/users/oswaldobapvicjr
- https://github.com/oswaldobapvicjr
- https://api.github.com/users/oswaldobapvicjr/gists%7B/gist_id%7D
- https://api.github.com/users/oswaldobapvicjr/repos
- https://avatars.githubusercontent.com/u/45291656?v=4
- https://api.github.com/users/oswaldobapvicjr/events%7B/privacy%7D