CVE-2009-4924: python-cjson Remote Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2009-4924: Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag o... Affects python-cjson versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- python-cjson · Debian:10
The same CVE-2009-4924 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-cjson is a Python extension module that provides a fast JSON encoder/decoder for Python. It is commonly used to encode and decode JSON data in Python applications. The vulnerability in python-cjson version 1.0.5 allows for a remote cross-site scripting (XSS) attack when handling a ['/'] argument to cjson.encode. This vulnerability can be exploited in conjunction with Firefox and the end tag of a SCRIPT element.
Vulnerability Detail
The vulnerability arises from a lack of proper handling of the ['/'] argument in the cjson.encode function. This allows remote attackers to conduct certain cross-site scripting (XSS) attacks. By manipulating the input, an attacker can inject malicious scripts into the output generated by python-cjson, which may be executed by a victim's browser. This can lead to various security risks, including the theft of sensitive information or the execution of unauthorized actions on behalf of the victim.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
pip install --upgrade "python-cjson==1.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to sanitize the input before passing it to the cjson.encode function. This can be done by removing or escaping any characters that may be interpreted as HTML or JavaScript code. Here is an example of how to sanitize the input using the 'html' module in Python:
import html
input_data = ['\/']
sanitized_data = html.escape(input_data)
encoded_data = cjson.encode(sanitized_data)
Conclusion
The python-cjson version 1.0.5 is vulnerable to a remote cross-site scripting (XSS) attack when handling a ['/'] argument in the cjson.encode function. This vulnerability can be exploited in conjunction with Firefox and the end tag of a SCRIPT element. To mitigate this vulnerability, it is advised to upgrade to python-cjson version 1.1.0 or later. Alternatively, users can sanitize the input before passing it to the cjson.encode function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-cjson →
FAQ
python-cjson is a Python extension module that provides a fast JSON encoder/decoder for Python. It is commonly used to encode and decode JSON data in Python applications.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various security risks, including the theft of sensitive information or the execution of unauthorized actions on behalf of the victim.
The python-cjson XSS vulnerability occurs when the ['/'] argument is not properly handled in the cjson.encode function. This allows remote attackers to inject malicious scripts into the output generated by python-cjson, which may be executed by a victim's browser.
The python-cjson XSS vulnerability can lead to various security risks, including the theft of sensitive information, session hijacking, and the execution of unauthorized actions on behalf of the victim.
To protect your application from the python-cjson XSS vulnerability, it is recommended to upgrade to python-cjson version 1.1.0 or later. Additionally, you can sanitize the input before passing it to the cjson.encode function by removing or escaping any characters that may be interpreted as HTML or JavaScript code.
Related vulnerabilities
Recent vulnerabilities recorded for python-cjson.
