CVE-2021-23899: Arbitrary code injection in json-sanitizer

Background

The json-sanitizer package, provided by com.mikesamuel, is a Maven ecosystem package used for sanitizing JSON data. It ensures that JSON input is safe to embed in HTML or XML documents. The package is designed to prevent cross-site scripting (XSS) attacks by removing potentially harmful content from JSON strings. However, prior to version 1.2.2, the package had a vulnerability that allowed for arbitrary code injection.

Vulnerability Detail

The vulnerability in json-sanitizer (before version 1.2.2) arises from the package emitting closing SCRIPT tags and CDATA section delimiters for crafted input. This flaw enables an attacker to inject arbitrary HTML or XML into embedding documents. By exploiting this vulnerability, an attacker can execute malicious code within the context of the embedding document, potentially leading to various security risks such as cross-site scripting attacks, data theft, or unauthorized access.

Workaround

As a temporary workaround, developers can manually sanitize the JSON input using alternative methods or libraries that are not affected by this vulnerability. One possible approach is to use a custom sanitization function that removes any potentially harmful content from the JSON string before embedding it in HTML or XML documents. Here's an example of a basic sanitization function in Java:

import org.apache.commons.text.StringEscapeUtils;

public class JsonSanitizer {
  public static String sanitize(String json) {
    // Remove potentially harmful content
    String sanitizedJson = StringEscapeUtils.escapeHtml4(json);
    return sanitizedJson;
  }
}

Conclusion

The json-sanitizer package, prior to version 1.2.2, is vulnerable to arbitrary code injection. This can be exploited by attackers to inject malicious HTML or XML into embedding documents, potentially leading to various security risks. To mitigate this vulnerability, it is crucial to upgrade the package to version 1.2.2 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for com.mikesamuel:json-sanitizer →

FAQ