CVE-2018-18855: Uncontrolled Resource Consumption in Spray JSON
Summary
CVE-2018-18855: Uncontrolled Resource Consumption in Spray JSON. Affects io.spray:spray-json versions < 1.3.5. Fixed in 1.3.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is io.spray:spray-json, which is a JSON library for the Scala programming language. It provides a simple and lightweight API for parsing and manipulating JSON data. The vulnerability in question is related to recursive descent parsers, which can lead to StackOverflowExceptions when processing deeply nested structures. This occurs because the current 'open' parsing state is kept on the stack, causing uncontrolled resource consumption.
Vulnerability Detail
The vulnerability arises from the inability of the parser to handle excessively nested JSON structures, resulting in a StackOverflowException. An attacker could exploit this vulnerability by crafting a malicious JSON payload with deeply nested elements, causing the application to crash or consume excessive resources. This vulnerability has a moderate severity rating and is classified under CWE-400.
How To Fix
Minimum fixed version
1.3.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by implementing input validation and limiting the depth of nested JSON structures that their application accepts. This can be achieved by setting a maximum depth limit during parsing or by using a JSON library that provides built-in protection against excessive recursion.
Conclusion
In conclusion, the io.spray:spray-json package is vulnerable to uncontrolled resource consumption when processing deeply nested JSON structures. To mitigate this vulnerability, it is crucial to update to version 1.3.5 or later. Implementing input validation and limiting the depth of nested JSON structures can also help reduce the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for io.spray:spray-json →
FAQ
The vulnerability can lead to denial of service (DoS) attacks, as an attacker can cause the application to crash or consume excessive resources by sending a specially crafted JSON payload.
While there is no known public exploit for this specific vulnerability, it is still important to address it to prevent potential attacks.
No, versions prior to 1.3.5 are affected. It is recommended to update to version 1.3.5 or later to mitigate the vulnerability.
No, the Common Vulnerability Scoring System (CVSS) score is not provided in the available information.
For more information, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-ww3v-6xjf-jv28/GHSA-ww3v-6xjf-jv28.json
