CVE-2021-31684
📋 TL;DR
A denial-of-service vulnerability exists in JSON Smart's indexOf function that allows attackers to crash applications via specially crafted JSON input. This affects applications using JSON Smart versions 1.3 or 2.4 for JSON parsing. The vulnerability can be triggered through web requests to affected applications.
💻 Affected Systems
- JSON Smart
📦 What is this software?
Json Smart V1 by Json Smart Project
Json Smart V2 by Json Smart Project
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to sustained denial of service, potentially affecting multiple services if the vulnerable component is shared.
Likely Case
Application instability or crashes when processing malicious JSON payloads, resulting in temporary service disruption.
If Mitigated
Minimal impact with proper input validation and rate limiting in place before JSON parsing occurs.
🎯 Exploit Status
Exploitation requires sending crafted JSON payloads to vulnerable endpoints. Public proof-of-concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: JSON Smart 2.4.2 or later
Vendor Advisory: https://github.com/netplex/json-smart-v2/issues/67
Restart Required: Yes
Instructions:
1. Update JSON Smart dependency to version 2.4.2 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to reject malformed JSON before it reaches the vulnerable parser
Rate Limiting
allImplement rate limiting on JSON parsing endpoints to reduce DoS impact
🧯 If You Can't Patch
- Implement WAF rules to block suspicious JSON payload patterns
- Isolate vulnerable services behind reverse proxies with request filtering
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for JSON Smart version 1.3 or 2.4Check Version:
Check build configuration files (pom.xml, build.gradle, package.json) for JSON Smart versionVerify Fix Applied:
Verify JSON Smart version is 2.4.2 or later in dependencies📡 Detection & Monitoring
Log Indicators:
- Application crashes or abnormal termination when processing JSON
- High CPU/memory usage spikes during JSON parsing
Network Indicators:
- Unusually large or malformed JSON payloads to application endpoints
- Repeated JSON requests causing service degradation
SIEM Query:
source="application_logs" AND ("JSON parsing error" OR "OutOfMemoryError" OR "StackOverflowError")🔗 References
- https://github.com/netplex/json-smart-v1/issues/10
- https://github.com/netplex/json-smart-v1/pull/11
- https://github.com/netplex/json-smart-v2/issues/67
- https://github.com/netplex/json-smart-v2/pull/68
- https://lists.debian.org/debian-lts-announce/2023/03/msg00030.html
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/netplex/json-smart-v1/issues/10
- https://github.com/netplex/json-smart-v1/pull/11
- https://github.com/netplex/json-smart-v2/issues/67
- https://github.com/netplex/json-smart-v2/pull/68
- https://lists.debian.org/debian-lts-announce/2023/03/msg00030.html
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
