CVE-2024-47855: JSON-lib denial of service via unbalanced comment in JSONTokener

Executive brief

JSON-lib is a Java library used to transform beans, maps, and XML into JSON format. A vulnerability in how the library processes comments within JSON data could allow an attacker to cause a minor service disruption. This typically affects the availability of the application processing the malformed data but does not risk data theft or unauthorized access.

Technical details

The vulnerability exists in the `util/JSONTokener.java` component of JSON-lib. It is caused by the improper handling of unbalanced comment strings during JSON parsing. An unauthenticated remote attacker can exploit this by providing a specially crafted JSON payload containing an unbalanced comment, which may lead to a denial of service (DoS) condition by impacting the availability of the parsing process. The issue is addressed in version 3.1.0 of the Kordamp json-lib-core fork; however, the original net.sf.json-lib:json-lib appears to remain unpatched in its last version (2.4).

Affected products

• Kordamp json-lib-core < 3.1.0
• net.sf.json-lib json-lib <= 2.4

Timeline

• 2024-10-04: disclosed
• 2024-10-04: advisory

References

• https://api.github.com/users/kmoens
• https://github.com/kmoens
• https://api.github.com/users/kmoens/gists%7B/gist_id%7D
• https://api.github.com/users/kmoens/repos
• https://avatars.githubusercontent.com/u/5837260?v=4
• https://api.github.com/users/kmoens/events%7B/privacy%7D