CVE-2021-23900: Denial of Service in json-sanitizer
Summary
CVE-2021-23900: Uncaught Exception leading to Denial of Service in json-sanitizer. Affects com.mikesamuel:json-sanitizer versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-sanitizer package, developed by com.mikesamuel, is a Maven ecosystem library used for sanitizing JSON input. It ensures that the output JSON is safe and conforms to the JSON specification. However, versions before 1.2.2 are vulnerable to a Denial of Service (DoS) attack. This vulnerability can lead to the generation of invalid JSON or trigger an undeclared exception when processing specially crafted input. Applications that do not handle these situations properly may experience a DoS condition.
Vulnerability Detail
The vulnerability (CVE-2021-23900) in json-sanitizer arises due to improper handling of crafted input. Attackers can exploit this vulnerability to cause a DoS condition in the target application. By providing malicious input, the json-sanitizer library may generate invalid JSON or throw an unexpected exception. This can overload the application, leading to service disruption or unhandled exceptions. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization mechanisms in their application code. By validating and sanitizing JSON input before passing it to the json-sanitizer library, the risk of triggering the vulnerability can be mitigated. Here's an example of how to sanitize JSON input using the json-sanitizer library in Java:
import com.mikesamuel.json.JsonSanitizer;
String inputJson = ...; // JSON input from user
String sanitizedJson = JsonSanitizer.sanitize(inputJson);
// Use the sanitized JSON in your application
Conclusion
The json-sanitizer package before version 1.2.2 is vulnerable to a Denial of Service (DoS) attack. Attackers can exploit this vulnerability to generate invalid JSON or trigger unhandled exceptions, leading to service disruption. To mitigate this risk, it is crucial to upgrade to json-sanitizer version 1.2.2 or later. Additionally, implementing input validation and sanitization mechanisms in your application code can provide temporary protection. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for com.mikesamuel:json-sanitizer →
FAQ
The vulnerability in json-sanitizer can lead to a Denial of Service (DoS) condition in the target application. This can result in service disruption or unhandled exceptions, potentially impacting the availability and reliability of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the pom.xml file of your project.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk of exploitation.
Yes, you can implement input validation and sanitization mechanisms in your application code to reduce the risk of triggering the vulnerability. By validating and sanitizing JSON input before passing it to the json-sanitizer library, you can mitigate the impact of this vulnerability.
For further support or assistance regarding vulnerability remediation, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.mikesamuel:json-sanitizer.
