CVE-2023-7272
📋 TL;DR
This vulnerability in Eclipse Parsson allows attackers to cause denial of service by sending JSON documents with deeply nested objects, triggering Java stack overflow exceptions. Any application using vulnerable versions of Eclipse Parsson for JSON processing is affected, particularly web services and APIs that accept JSON input.
💻 Affected Systems
- Eclipse Parsson
📦 What is this software?
Parsson by Eclipse
Parsson by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to stack overflow crashes, potentially affecting multiple services if shared library is used.
Likely Case
Targeted denial of service against specific endpoints that process JSON, causing intermittent service disruptions.
If Mitigated
Limited impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires sending malicious JSON payloads to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4 or 1.1.3
Vendor Advisory: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/12
Restart Required: Yes
Instructions:
1. Update Parsson dependency to version 1.0.4 or 1.1.3. 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Implement JSON depth validation
allAdd input validation to limit maximum nesting depth of JSON documents before parsing
Configure JVM stack size
allIncrease Java stack size to reduce likelihood of overflow (temporary mitigation)
java -Xss2m -jar yourapp.jar
🧯 If You Can't Patch
- Implement WAF rules to block JSON documents with excessive nesting depth
- Deploy rate limiting on JSON processing endpoints to limit attack impact
🔍 How to Verify
Check if Vulnerable:
Check Parsson version in dependencies: mvn dependency:tree | grep parsson or gradle dependencies | grep parssonCheck Version:
java -cp "parsson-*.jar" org.eclipse.parsson.VersionVerify Fix Applied:
Confirm Parsson version is 1.0.4+ or 1.1.3+ in dependency manifest📡 Detection & Monitoring
Log Indicators:
- StackOverflowError in logs
- OutOfMemoryError related to JSON parsing
- Abnormal termination of JSON processing threads
Network Indicators:
- Large JSON payloads with repeated nesting patterns
- Sudden spikes in JSON processing requests
SIEM Query:
source="application.logs" AND ("StackOverflowError" OR "java.lang.StackOverflowError") AND "JSON"