Deserialization of Untrusted Data in com.jsoniter:jsoniter [CVE-2021-23441] #303

Activity

1. dagnelies commented on Oct 6, 2021

   

   dagnelies

   on Oct 6, 2021

   More actions

   I just had a closer look at this CVE out of curiosity and I'm rather dumbfolded ...is it just me, or is it just plain nonsense?!
2. plokhotnyuk commented on Oct 6, 2021

   

   plokhotnyuk

   on Oct 6, 2021

   Last edited by plokhotnyuk

   Contributor

   More actions

   While code snippets from snyk.io look harmless there are can be some real vulnerabilities:

   1. DoS attack that exploits O(n)^2 complexity of parsing some classes (where n is number of input characters) like BigInteger/BigDecimal;
   2. DoS attack that exploits OutOfMemory errors during parsing of some classes like BitSets;
   3. DoS attack that exploits StackOverflow errors during parsing of deeply nested JSON objects/arrays (or recursive classes);
   4. RCE attack that exploits the ability to parse unregistered class by type discriminator from the input.

   I don't know if any of them exists for json-iterator yet.

   An acceptable solution for possible DoS attacks would be introducing some configurable limits (max number of digits, max bitset value, max level of nesting, etc.) with reasonable defaults.

   Here and here are examples of how DoS vulnerabilities of json4s library were tested with jsoniter-scala harness.
3. plokhotnyuk commented on Oct 20, 2021

   

   plokhotnyuk

   on Oct 20, 2021

   Contributor

   More actions

   I found more detailed samples here
4. xsun12 commented on Oct 26, 2021

   

   xsun12

   on Oct 26, 2021

   Last edited by xsun12

   More actions

   @plokhotnyuk

   I found more detailed samples here

   Telegram is not accessible from my part of the world. Can someone copy the detailed samples here?
5. plokhotnyuk commented on Oct 26, 2021

   

   plokhotnyuk

   on Oct 26, 2021

   Contributor

   More actions

   @xsun12 4_5960538858721381440.pdf
6. dagnelies commented on Oct 26, 2021

   

   dagnelies

   on Oct 26, 2021

   More actions

   @plokhotnyuk I don't see why any of that is problematic. It's ridiculous. There is no DoS or any vulnerability inside this pdf. It's just calling the setters. It's just what setters are for, it's the expected behaviour and I think all other json libs works exactly like this. Anything else would seem strange to me.

   Also, regarding the "potential" vulnerabilities, isn't the role of a vulnerability report to proove that there is one, instead of "well, maybe there is something, no idea though, I haven't any working example".
7. dagnelies commented on Oct 26, 2021

   

   dagnelies

   on Oct 26, 2021

   Last edited by dagnelies

   More actions

   It would be nice if they would actually provide some real DoS or RCE example instead of alarming the world with unfounded claims and pure speculations.

   PS: I'm not affiliated with this project in any way ...it just popped up in one of my projects as dependency alarm

   PS @plokhotnyuk : Thanks for the link ...it's a pity that such a "CVE" is published without even being reviewed.