CVE-2023-35110
📋 TL;DR
CVE-2023-35110 is a vulnerability in jjson library versions through 0.1.7 where attackers can cause denial of service or other impacts by sending JSON objects with cyclic dependencies. This affects any application using vulnerable jjson versions for JSON parsing. The cyclic references cause infinite recursion during parsing, consuming system resources.
💻 Affected Systems
- jjson library
📦 What is this software?
Jjson by Jjson Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through resource exhaustion (CPU/memory), potentially leading to application crashes and service unavailability.
Likely Case
Application instability, increased resource consumption, and degraded performance when processing malicious JSON payloads.
If Mitigated
Minimal impact with proper input validation, resource limits, and updated library versions.
🎯 Exploit Status
The exploit requires sending a specially crafted JSON object with cyclic references. No authentication is needed if the service accepts JSON input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.1.8 or later
Vendor Advisory: https://github.com/grobmeier/jjson/issues/2
Restart Required: Yes
Instructions:
1. Update jjson dependency to version 0.1.8 or later. 2. Update package.json or build configuration. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement JSON schema validation or input sanitization to reject objects with cyclic dependencies
Resource limiting
allConfigure application to limit recursion depth and resource usage during JSON parsing
🧯 If You Can't Patch
- Implement WAF rules to detect and block JSON objects with cyclic references
- Isolate vulnerable services behind reverse proxies with request filtering capabilities
🔍 How to Verify
Check if Vulnerable:
Check package.json or dependency manifest for jjson version <= 0.1.7Check Version:
npm list jjson (for Node.js) or check project dependency filesVerify Fix Applied:
Verify jjson version is 0.1.8 or later in package.json and test with cyclic JSON objects📡 Detection & Monitoring
Log Indicators:
- High CPU/memory usage spikes
- Application crashes during JSON parsing
- Stack overflow errors in logs
Network Indicators:
- Unusually large JSON payloads
- Repeated JSON parsing requests
SIEM Query:
source=application_logs AND ("stack overflow" OR "out of memory" OR "recursion depth") AND process="*jjson*"