CVE-2024-21907
📋 TL;DR
Newtonsoft.Json versions before 13.0.1 contain a vulnerability where specially crafted JSON data can trigger a StackOverflowException when deserialized, causing denial of service. This affects any application using vulnerable versions of the library for JSON parsing. Remote, unauthenticated attackers could potentially crash applications by sending malicious JSON payloads.
💻 Affected Systems
- Newtonsoft.Json (Json.NET)
- Any application using Newtonsoft.Json library
📦 What is this software?
Json.net by Newtonsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash and denial of service for all users, potentially requiring manual restart of affected services.
Likely Case
Application crashes when processing malicious JSON input, causing temporary service disruption until automatic or manual recovery.
If Mitigated
Minimal impact with proper input validation and updated library versions preventing exploitation.
🎯 Exploit Status
Exploitation requires sending crafted JSON data to applications that deserialize untrusted input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.0.1 and later
Vendor Advisory: https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
Restart Required: Yes
Instructions:
1. Update Newtonsoft.Json NuGet package to version 13.0.1 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated library.
🔧 Temporary Workarounds
Input Validation and Size Limits
allImplement input validation and size limits on JSON data before deserialization
WAF/Proxy Protection
allConfigure web application firewalls or reverse proxies to block or limit large JSON payloads
🧯 If You Can't Patch
- Implement strict input validation to reject malformed JSON before deserialization
- Deploy rate limiting and request size limits to prevent exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Newtonsoft.Json assembly version in application dependencies or NuGet package referencesCheck Version:
For .NET applications: check packages.config or .csproj file for Newtonsoft.Json package versionVerify Fix Applied:
Verify Newtonsoft.Json version is 13.0.1 or higher in application dependencies📡 Detection & Monitoring
Log Indicators:
- StackOverflowException in application logs
- Application crash/restart events
- Unusually large JSON payloads in request logs
Network Indicators:
- Large JSON payloads to deserialization endpoints
- Repeated crash/restart patterns
SIEM Query:
source="application_logs" AND ("StackOverflowException" OR "Newtonsoft.Json" AND "crash")🔗 References
- https://alephsecurity.com/2018/10/22/StackOverflowException/
- https://alephsecurity.com/vulns/aleph-2018004
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
- https://alephsecurity.com/2018/10/22/StackOverflowException/
- https://alephsecurity.com/vulns/aleph-2018004
- https://github.com/JamesNK/Newtonsoft.Json/commit/7e77bbe1beccceac4fc7b174b53abfefac278b66
- https://github.com/JamesNK/Newtonsoft.Json/issues/2457
- https://github.com/JamesNK/Newtonsoft.Json/pull/2462
- https://github.com/advisories/GHSA-5crp-9r3c-p9vr
- https://security.snyk.io/vuln/SNYK-DOTNET-NEWTONSOFTJSON-2774678
- https://vulncheck.com/advisories/vc-advisory-GHSA-5crp-9r3c-p9vr
