CVE-2020-27196: Out-of-bounds Write in Play Framework
Summary
CVE-2020-27196: Out-of-bounds Write in Play Framework. Affects com.typesafe.play:play across 2 version ranges.
>= 2.6.0, < 2.7.6
>= 2.8.0, < 2.8.3
Fixed in 2.7.6 or 2.8.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Play Framework is a web application framework written in Java and Scala. It provides a set of tools and libraries for building scalable and efficient web applications. The vulnerability affects versions 2.6.0 through 2.8.2 of the Play Framework and PlayJava. PlayJava is a Java API for the Play Framework. The vulnerability allows an attacker to trigger a StackOverflowError and cause a Denial of Service (DoS) by sending a deep JSON structure to a valid POST endpoint. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
Vulnerability Detail
The vulnerability arises from the eager parsing of HTTP request payloads in PlayJava. When a Content-Type header is present, the framework attempts to parse the payload accordingly. However, a deep JSON structure sent to a valid POST endpoint, even if it does not expect JSON payloads, can lead to a StackOverflowError. This can result in a DoS condition, rendering the affected application unresponsive. The vulnerability is assigned the CVE identifier CVE-2020-27196 and has been classified under CWE-787.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.6.0, < 2.7.62.7.6 -
>= 2.8.0, < 2.8.32.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of the Play Framework or PlayJava.
Conclusion
The vulnerability in the Play Framework and PlayJava allows an attacker to trigger a DoS condition by sending a deep JSON structure to a valid POST endpoint. Upgrading to the fixed versions of the framework is necessary to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.typesafe.play:play →
FAQ
The vulnerability can lead to a Denial of Service (DoS) condition, causing the affected application to become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it in real-time.
No, authentication is not required to exploit this vulnerability. An attacker can trigger the vulnerability by sending a specially crafted HTTP request.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
No, the recommended mitigation is to upgrade to the fixed versions of the Play Framework or PlayJava.
Related vulnerabilities
Recent vulnerabilities recorded for com.typesafe.play:play.
