CVE-2023-5072

Overview

JSON-java (org.json) is a widely used reference implementation of JSON in Java. It provides the JSONObject, JSONArray, and JSONTokener classes that Java applications use to parse, build, and serialize JSON documents.

A Denial of Service vulnerability (CVE-2023-5072) has been identified in JSON-java (org.json), which allows a remote attacker to submit a small crafted JSON document whose object key is itself a nested JSON object. When the parser accepts such a key and the structure is later re-serialized, the escaping of nested quotation marks grows exponentially with nesting depth, exhausting the JVM heap and raising an OutOfMemoryError that denies service.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

NVD and the Google CNA both score this vulnerability 7.5 (High) under CVSS v3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting an availability-only impact: no privileges and no user interaction are required, and the outcome is denial of service with no confidentiality or integrity effect.

This issue affects all released versions of JSON-java up to and including 20230618, which encompasses the 20230227 release that HeroDevs supports.

‍

Details

Module Info

• Product: JSON-java
• Affected packages: org.json:json
• Affected versions: <=20230618
• GitHub repository: https://github.com/stleary/JSON-java
• Published packages: https://central.sonatype.com/artifact/org.json/json
• Package manager: Maven
• Fixed in: NES for JSON-java
  • NES for JSON-java: 20230227.0.2
  • OSS JSON-java (org.json:json): 20231013

Vulnerability Info

This High-severity vulnerability is found in the org.json:json package in all versions of JSON-java up to and including 20230618. The flaw combines two parser weaknesses that together let a small input consume unbounded memory.

First, JSONTokener.next() returns the value 0 both for a genuine NUL (\0) byte in the input and for true end-of-stream:

public char next() throws JSONException {
    int c;
    ...
    if (c <= 0) { // End of stream
        this.eof = true;
        return 0;
    }
    ...
}

Because the object-key parse loop in JSONObject treats a returned 0 as end-of-input, a crafted key that embeds a \0 byte can slip past the loop's guards. Second, that same loop only rejects a nested-object-as-key when the immediately preceding character was {, and it otherwise reads the key with x.nextValue(), which can recurse into a full JSON value:

char prev = x.getPrevious();
c = x.nextClean();
switch (c) {
case 0:
    throw x.syntaxError("A JSONObject text must end with '}'");
case '}':
    return;
case '{':
case '[':
    if (prev == '{') {
        throw x.syntaxError("A JSON Object can not directly nest another JSON Object or JSON Array.");
    }
    // falls through
default:
    x.back();
    key = x.nextValue().toString();
}

By pairing the \0 trick with a key that is itself a nested JSON object, an attacker makes the parser accept an object whose key is another object. When that structure is later serialized back to text with toString(), each level of nesting must backslash-escape the quotation marks of the level below it, so the number of backslash characters grows exponentially with nesting depth. A request of roughly 367 bytes, nesting object-keys about 30 deep, is enough to exhaust the JVM heap and raise an OutOfMemoryError. Any code path that builds a JSONObject or JSONArray from attacker-influenced text, such as new JSONObject(String), new JSONArray(String), or XML.toJSONObject, is reachable with the default parser and no special configuration; the impact is limited to availability, with no data disclosure or code execution.

This vulnerability has been present since at least the 20070829 release of JSON-java.

‍

Mitigation

Only the most recent release of JSON-java is community-supported; the project ships a single rolling, date-stamped release train, and each new release immediately supersedes the previous one. The affected 20230227 release has been superseded and will not receive public updates to address this issue.

The affected 20230227 line is End-of-Life and has no publicly available fix; NES for JSON-java is the remedy for that line.

Users of the affected components should apply one of the following mitigations:

• Upgrade org.json:json to release 20231013 or later, which contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Éamonn McManus from Google (finder)