CVE-2023-51074

Overview

JsonPath (com.jayway.jsonpath) is a widely used Java library implementing the JsonPath query language, comparable to XPath for XML, for extracting and filtering data out of JSON documents.

A Denial of Service vulnerability (CVE-2023-51074) has been identified in JsonPath, which allows a remote attacker to submit a small, malformed JSONPath expression that causes the parser to recurse into itself indefinitely. When the expression is evaluated through the deprecated Criteria.parse() or Criteria.where() entry points, an unterminated bracket or escape sequence is not detected as invalid syntax, and the internal tokenizer calls back into itself with no terminating condition until the thread’s call stack is exhausted and a StackOverflowError is thrown.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

NVD scores this vulnerability 5.3 (Medium) under CVSS v3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting an availability-only impact of limited severity: no privileges and no user interaction are required, and the outcome is a single thread crashing with no confidentiality or integrity effect.

This issue affects JsonPath versions 2.2.0 up to but not including 2.9.0, which encompasses the 2.7.0 release that HeroDevs supports.

Details

Module Info

• Product:
  
  • JsonPath
• Affected packages:
  
  • com.jayway.jsonpath:json-path
• Affected versions:
  
  • >= 2.2.0, < 2.9.0
• GitHub repository: https://github.com/json-path/JsonPath
• Published packages: https://central.sonatype.com/artifact/com.jayway.jsonpath/json-path
• Package manager:
  
  • Maven
• Fixed in:
  
  • NES for JsonPath: 2.7.0-json-path-2.7.2
  • OSS JsonPath (com.jayway.jsonpath:json-path): 2.9.0

Vulnerability Info

This Medium-severity vulnerability is found in the com.jayway.jsonpath:json-path package in versions 2.2.0 up to but not including 2.9.0. The flaw is an instance of uncontrolled recursion (CWE-674) in the internal expression tokenizer.

When Criteria.parse() or Criteria.where() compiles a JSONPath expression, bracket-property tokens are read by PathCompiler.readBracketPropertyToken(), which previously assumed a closing ] would always be found and advanced past it unconditionally:

int endBracketIndex = path.indexOfNextSignificantChar(endPosition, CLOSE_SQUARE_BRACKET) + 1;

path.setPosition(endBracketIndex);
...
return path.currentIsTail() || readNextToken(appender);

When the input contains an unmatched bracket or escape sequence, this method, readNextToken(), and readPropertyOrFunctionToken() call back into each other with no base case: each pass fails to recognize the malformed syntax as invalid and hands control back to the next method in the cycle, consuming a stack frame each time.

A single crafted expression, such as @["",/\, is enough to drive this cycle until the thread’s call stack is exhausted and a StackOverflowError is thrown. Any application that evaluates a JSONPath expression built from attacker-influenced text through Criteria.parse() or Criteria.where() is reachable with no special configuration; the impact is limited to availability, with no data disclosure or code execution.

This vulnerability has been present since at least JsonPath 2.2.0, the earliest version listed as affected by the advisory.

Mitigation

JsonPath ships a single actively-supported release line; fixes land only on the latest tagged version, and there is no upstream mechanism to receive a patch while remaining on an older minor version such as 2.7.x.

The affected 2.7.x line has no publicly available fix for this issue without moving to 2.9.0; NES for JsonPath is the remedy for projects that need to stay on 2.7.x.

Users of the affected components should apply one of the following mitigations:

• Upgrade com.jayway.jsonpath:json-path to release 2.9.0 or later, which contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for JsonPath 2.7.0-json-path-2.7.2 or later; see the NES for JsonPath release notes for details.

Credits

PoppingSnack is credited with finding this vulnerability.