CVE-2020-35381: Panic due to improper input validation in github.com/buger/jsonparser

Background

The package under scrutiny is github.com/buger/jsonparser, which is a Go library for parsing JSON data. It provides various functions for extracting values from JSON objects and arrays. The vulnerability in this package arises from improper input validation, specifically in the bounds checking mechanism. This flaw allows maliciously crafted JSON objects to trigger an out-of-bounds panic. If this library is used for parsing user input, it can be exploited as a denial of service vector.

Vulnerability Detail

The vulnerability (CVE-2020-35381) in github.com/buger/jsonparser stems from a lack of proper bounds checking during JSON parsing. This allows an attacker to create specially crafted JSON objects that trigger an out-of-bounds panic. The impact of this vulnerability is primarily a denial of service, as it can cause the affected application to crash. The vulnerability can be exploited by providing malicious input to the parsing functions of the library. It is important to note that this vulnerability only affects versions 0.0.0 to 1.1.0 of the library, with the fix implemented in version 1.1.1.

go get github.com/buger/jsonparser@v1.1.1

Workaround

If updating to the latest version of github.com/buger/jsonparser is not feasible, a possible workaround is to implement additional input validation before passing JSON data to the library. This can involve validating the structure and size of the JSON objects and arrays to ensure they fall within expected bounds. Here is an example of how this can be done in Go:

import (
	"github.com/buger/jsonparser"
	"fmt"
)

func parseJSON(data []byte) {
	// Perform additional input validation
	if len(data) > MAX_JSON_SIZE {
		fmt.Println("JSON data exceeds maximum size")
		return
	}

	// Parse JSON using github.com/buger/jsonparser
	// ...
}

Conclusion

In conclusion, the vulnerability (CVE-2020-35381) in github.com/buger/jsonparser allows for an out-of-bounds panic due to improper input validation. This can be exploited by providing malicious JSON input, leading to a denial of service. To mitigate this vulnerability, developers should update to version 1.1.1 or later of the library. If updating is not possible, implementing additional input validation can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/buger/jsonparser →

FAQ

import (
	"github.com/buger/jsonparser"
	"fmt"
)

func parseJSON(data []byte) {
	// Perform additional input validation
	if len(data) > MAX_JSON_SIZE {
		fmt.Println("JSON data exceeds maximum size")
		return
	}

	// Parse JSON using github.com/buger/jsonparser
	// ...
}