CVE-2022-45688: json stack overflow vulnerability in hutool-json and org.json:json
Summary
CVE-2022-45688: json stack overflow vulnerability. Affects cn.hutool:hutool-json versions < 5.8.25. Fixed in 5.8.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hutool-json library is a JSON processing library for Java that provides various utility methods for working with JSON data. It is commonly used in Java applications for parsing and manipulating JSON objects. The org.json:json library is another popular JSON library for Java. Both libraries are widely used in Maven projects.
The vulnerability identified as CVE-2022-45688 is a stack overflow vulnerability in the XML.toJSONObject component of hutool-json v5.8.10 and org.json:json before version 20230227. This vulnerability allows attackers to cause a Denial of Service (DoS) by exploiting crafted JSON or XML data. The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
Vulnerability Detail
The stack overflow vulnerability in the XML.toJSONObject component of hutool-json and org.json:json allows attackers to trigger a Denial of Service (DoS) attack by providing specially crafted JSON or XML data. When the vulnerable component processes the malicious input, it fails to handle the stack overflow condition properly, leading to the application crashing or becoming unresponsive.
This vulnerability can be exploited remotely without authentication, making it a significant security concern. An attacker can send a malicious request containing the crafted JSON or XML data to the application, causing it to consume excessive stack memory and resulting in a DoS condition. This can lead to service disruption and impact the availability of the affected application.
How To Fix
Minimum fixed version
5.8.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the hutool-json and org.json:json libraries to the patched versions.
Conclusion
The stack overflow vulnerability in the XML.toJSONObject component of hutool-json and org.json:json can be exploited by attackers to cause a Denial of Service (DoS) by providing specially crafted JSON or XML data. To mitigate this vulnerability, it is crucial to update the hutool-json library to version 5.8.11 or later, and the org.json:json library to version 20230227 or later. This will ensure that the necessary patches are applied to address the stack overflow issue. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cn.hutool:hutool-json →
FAQ
This vulnerability allows attackers to cause a Denial of Service (DoS) by exploiting crafted JSON or XML data. It can lead to service disruption and impact the availability of the affected application.
Yes, this vulnerability can be exploited remotely without authentication. Attackers can send a malicious request containing the crafted JSON or XML data to the application.
This vulnerability is rated as HIGH severity with a CVSS score of 7.5.
Yes, the vulnerability can be mitigated by updating the hutool-json library to version 5.8.11 or later, and the org.json:json library to version 20230227 or later.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by updating the affected libraries.
References
Related vulnerabilities
Recent vulnerabilities recorded for cn.hutool:hutool-json.
