CVE-2021-42248: Denial of Service in github.com/tidwall/gjson

Background

The package github.com/tidwall/gjson is a Go library that provides a fast and simple way to parse JSON data. It offers functions like Get, GetBytes, GetMany, GetManyBytes, Result.Get, parseObject, and queryMatches to extract values from JSON documents. However, a vulnerability has been discovered in this package that can lead to a denial of service (DoS) attack when processing a maliciously crafted path. This vulnerability affects versions 0 through 1.9.2 of the package.

Vulnerability Detail

The vulnerability in github.com/tidwall/gjson arises from a flaw in the handling of certain paths during JSON parsing. An attacker can exploit this flaw by providing a specially crafted path that triggers excessive CPU and time consumption when using functions like Get and other query functions. This can result in a DoS condition, causing the application to become unresponsive or crash. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the affected application.

go get github.com/tidwall/gjson@v1.20.0

go get github.com/tidwall/gjson@v1.9.3

Workaround

As a workaround, developers can implement input validation and sanitization to ensure that the paths provided to the affected functions are not maliciously crafted. By validating and sanitizing user input, the risk of triggering the vulnerability can be mitigated. Here is an example of input validation and sanitization for the Get function:

def validatePath(path string) (string, error) {
  // Perform input validation and sanitization
  // Return sanitized path or error if validation fails
}

func main() {
  path := validatePath(userInput)
  if path != nil {
    value := gjson.Get(jsonData, path)
    // Process the value
  }
}

Conclusion

In conclusion, the github.com/tidwall/gjson package is vulnerable to a denial of service (DoS) attack due to a flaw in path handling. This vulnerability can be mitigated by upgrading to version 1.9.3 or later of the package and implementing input validation and sanitization. Developers should take immediate action to protect their applications from this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/tidwall/gjson →

FAQ