CVE-2020-10663 – This vulnerability in the JSON gem for Ruby all... (How to Fix)

Q: What is the severity of CVE-2020-10663?

CVE-2020-10663 has a CVSS score of 7.5 (HIGH). This vulnerability in the JSON gem for Ruby allows attackers to create malicious objects during JSON parsing, potentially leading to arbitrary code execution or denial of service. It affects Ruby applications using JSON gem versions through 2.2.0, particularly those running Ruby 2.4 through 2.6.5. The impact depends on how the application processes untrusted JSON input.

📋 TL;DR

This vulnerability in the JSON gem for Ruby allows attackers to create malicious objects during JSON parsing, potentially leading to arbitrary code execution or denial of service. It affects Ruby applications using JSON gem versions through 2.2.0, particularly those running Ruby 2.4 through 2.6.5. The impact depends on how the application processes untrusted JSON input.

💻 Affected Systems

Products:

Ruby JSON gem
Ruby interpreter

Versions: JSON gem ≤ 2.2.0, Ruby 2.4.0-2.4.9, 2.5.0-2.5.7, 2.6.0-2.6.5

Operating Systems: All operating systems running affected Ruby versions

Default Config Vulnerable: ⚠️ Yes

Notes: Applications using JSON.parse or similar methods with untrusted input are vulnerable. The vulnerability is similar to CVE-2013-0269 but doesn't rely on Ruby's garbage collection behavior.

📦 What is this software?

Macos by Apple

macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...

Learn more about Macos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Denial of service through application crashes or resource exhaustion, potentially leading to data corruption.

🟢

If Mitigated

Limited impact if input validation and sanitization prevent malicious JSON from reaching vulnerable parsers.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malicious JSON to vulnerable endpoints. The vulnerability is well-documented and similar to previous JSON parsing issues.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: JSON gem ≥ 2.3.0, Ruby ≥ 2.4.10, ≥ 2.5.8, ≥ 2.6.6

Vendor Advisory: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Restart Required: Yes

Instructions:

1. Update Ruby to version 2.4.10, 2.5.8, 2.6.6 or later. 2. Update JSON gem to version 2.3.0 or later using 'gem update json'. 3. Restart all Ruby applications and services.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Implement strict input validation to reject or sanitize untrusted JSON before parsing.

Use Safe Parsing Methods

all

Use JSON.parse with the 'create_additions' option set to false to disable object creation during parsing.

JSON.parse(json_string, create_additions: false)

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable systems from untrusted networks.
Deploy web application firewalls (WAF) with JSON parsing protection rules.

🔍 How to Verify

Check if Vulnerable:

Check Ruby version with 'ruby -v' and JSON gem version with 'gem list json'.

Check Version:

ruby -v && gem list json

Verify Fix Applied:

Verify Ruby version is ≥ 2.4.10, ≥ 2.5.8, or ≥ 2.6.6, and JSON gem is ≥ 2.3.0.

📡 Detection & Monitoring

Log Indicators:

Unexpected application crashes
Memory usage spikes during JSON parsing
Unusual error messages from JSON parser

Network Indicators:

Large or malformed JSON payloads to Ruby application endpoints
Repeated JSON parsing requests causing performance degradation

SIEM Query:

source="application.log" AND ("JSON::ParserError" OR "unexpected token" OR "memory allocation")

📊 Metadata

CVE ID: CVE-2020-10663

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE: CWE-20

Published: April 28, 2020

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-10663, you might also want to check these: