CVE-2023-1370: net.minidev json-smart uncontrolled recursion in JSON parser

CVE-2023-1370 · Severity: high · CVSS 7.5 · Published 2023-03-23

The json-smart library, a Java tool used for processing JSON data, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, deeply nested JSON file that causes the software to crash by exhausting its memory resources. This can lead to service outages and impact the availability of applications that rely on this library for data processing.

Technologies: net.minidev:json-smart (Maven). Vendors: Maven.

Quick answers

Is CVE-2023-1370 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-1370 being exploited in the wild.
How severe is CVE-2023-1370?
High severity, with a CVSS score of 7.5, published 23 March 2023.
Which products and versions are affected?
net.minidev:json-smart (Maven) < 2.4.9, ECOSYSTEM:introduced=0,fixed=2.4.9; Net.Minidev Json-Smart < 2.4.9.
Is there a fix for CVE-2023-1370?
Yes. net.minidev:json-smart (Maven): upgrade to 2.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-1370 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-1370?
Check whether you run net.minidev:json-smart (Maven) or Net.Minidev Json-Smart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • net.minidev:json-smart (Maven): upgrade to 2.4.9 or later
    # set net.minidev:json-smart to 2.4.9 in your pom.xml or build.gradle

Technical details

The net.minidev:json-smart library fails to implement limits on the nesting depth of JSON arrays and objects. Because the parser uses recursion to handle these structures, an attacker can provide a JSON input with extreme nesting levels to trigger a StackOverflowError. This is a remote, unauthenticated attack vector that results in a complete crash of the JVM process (Denial of Service). The issue is classified as CWE-674 (Uncontrolled Recursion) and was addressed in version 2.4.9, though version 2.4.10 is recommended by maintainers to address subsequent bugs.

Affected products

  • net.minidev json-smart < 2.4.9

Identifiers

  • CVE-2023-1370
  • GHSA-493p-pfq6-5258

Timeline

  • 2023-03-22: advisory: NVD publication date
  • 2023-03-23: disclosed: GitHub Advisory published
  • 2023-03-23: patched: Version 2.4.9 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.