CVE-2022-23535: LiteDB Deserialization of Bad JSON

Background

LiteDB is a lightweight embedded NoSQL database for .NET. It allows developers to store and retrieve data using a simple document-oriented approach. LiteDB utilizes a special field in JSON documents to cast different types from BsonDocument to POCO classes. This feature enables the mapping of JSON data to object properties. However, when an instance of an object does not match the class, LiteDB uses a special field called _type to load and fit the object into the model. This vulnerability arises when deserialization attempts to load an unsafe object from a plain JSON string, potentially leading to security issues.

Vulnerability Detail

The vulnerability in LiteDB arises from the deserialization of bad JSON on object types using the _type field. If an end-user can send a plain JSON string to the application, the deserialization process may load an unsafe object that can fit into the model. This can result in various security risks, such as remote code execution or data manipulation. While version 5.0.13 of LiteDB includes some basic fixes to mitigate this vulnerability, it is not guaranteed to be 100% effective when using the Object type. A future major version of LiteDB will introduce an allow-list to control the loading of assemblies. To address this vulnerability, it is recommended to avoid direct insertion or update of plain JSON strings into the database and to refrain from using classes with the Object type. Instead, consider using interfaces or specific data structures to ensure safer deserialization.

Workaround

To mitigate the vulnerability, consider the following workarounds:

• Avoid allowing users to directly insert or update plain JSON strings into the database.
• Refrain from using classes with the Object type. Instead, use interfaces or specific data structures.

For example:

// Bad

public class Customer { public int Id { get; set; } public string Name { get; set; } public Object AnyData { get; set; } // Avoid using Object base type

}

// Good

public class Customer { public int Id { get; set; } public string Name { get; set; } public IDictionary<string, string> AnyData { get; set; } // Will accept only key/value strings

}

Conclusion

The vulnerability in LiteDB related to the deserialization of bad JSON on object types using the _type field can have severe security implications. It is crucial to update LiteDB to version 5.0.13 or later and follow the recommended workarounds to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for LiteDB →

FAQ