CVE-2021-42248: Denial of service in github.com/tidwall/gjson

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The package github.com/tidwall/gjson is a Go library that provides a fast and simple way to parse JSON data. It offers various functions for querying and extracting data from JSON documents. However, a vulnerability has been discovered in the package that can lead to a denial of service (DoS) condition. This vulnerability can be triggered by a maliciously crafted path, causing excessive CPU and time consumption in functions like Get and query functions.

Vulnerability Detail

The vulnerability (CVE-2021-42248) in github.com/tidwall/gjson arises from the mishandling of certain input paths. When a specially crafted path is provided to functions like Get and query functions, the package fails to handle it efficiently, resulting in excessive CPU and time consumption. This can be exploited by an attacker to launch a DoS attack, causing the affected application to become unresponsive or crash. The impact of this vulnerability can be severe, especially in scenarios where the package is used in critical systems or services.

go get github.com/tidwall/gjson@v1.20.0

go get github.com/tidwall/gjson@v1.9.3

Workaround

As a workaround, if updating the package is not immediately feasible, developers can implement input validation and sanitization mechanisms to filter out potentially malicious paths. By carefully validating and sanitizing user-supplied input before passing it to functions like Get and query functions, the risk of exploitation can be reduced. Here's an example of input validation in Go:

import (
	"github.com/tidwall/gjson"
	"regexp"
)

func validatePath(path string) bool {
	// Define a regular expression pattern to match valid paths
	pattern := regexp.MustCompile(`^[a-zA-Z0-9_]+$`)

	// Check if the provided path matches the pattern
	return pattern.MatchString(path)
}

In this example, the validatePath function uses a regular expression pattern to ensure that the path only contains alphanumeric characters and underscores. By validating the input before using it in functions from the github.com/tidwall/gjson package, the risk of triggering the vulnerability can be mitigated.

Conclusion

In conclusion, the github.com/tidwall/gjson package is vulnerable to a denial of service (DoS) attack due to the mishandling of certain input paths. This can be exploited by an attacker to consume excessive CPU and time, leading to application unresponsiveness or crashes. To mitigate this vulnerability, it is crucial to update the package to version 1.9.3 or later. Additionally, implementing input validation and sanitization mechanisms can provide a temporary workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for github.com/tidwall/gjson →

FAQ