CVE-2020-36066: Denial of service in github.com/tidwall/gjson

Background

The package github.com/tidwall/gjson is a Go library that provides a fast and efficient way to parse and query JSON data. It offers functions like Get, GetBytes, GetMany, GetManyBytes, Result.Get, parseObject, and queryMatches to extract specific values from JSON documents. However, a vulnerability has been discovered in this package that can lead to a denial of service attack.

Vulnerability Detail

A maliciously crafted JSON input can trigger the vulnerability in github.com/tidwall/gjson, causing a denial of service attack. This vulnerability can be exploited by an attacker to consume excessive resources, leading to a system crash or unresponsiveness. The issue arises due to improper handling of certain JSON inputs, allowing an attacker to exploit this weakness and disrupt the normal functioning of the application.

go get github.com/tidwall/gjson@v1.20.0

go get github.com/tidwall/gjson@v1.6.5

Workaround

As a temporary workaround, developers can implement input validation and sanitization mechanisms to filter out potentially malicious JSON inputs. By carefully validating and sanitizing the JSON data before passing it to the vulnerable functions, the risk of exploitation can be mitigated. Here's an example of how to validate and sanitize JSON inputs in Go:

import (
	"encoding/json"
	"github.com/tidwall/gjson"
)

func validateAndSanitizeJSON(input []byte) ([]byte, error) {
	var jsonData interface{}
	err := json.Unmarshal(input, &jsonData)
	if err != nil {
		return nil, err
	}

	// Perform additional validation and sanitization steps

	return json.Marshal(jsonData)
}

Conclusion

In conclusion, the package github.com/tidwall/gjson is vulnerable to a denial of service attack due to improper handling of certain JSON inputs. To mitigate this vulnerability, it is crucial to update the package to version 1.6.5 or later. Additionally, implementing input validation and sanitization mechanisms can provide temporary protection. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for github.com/tidwall/gjson →

FAQ