CVE-2023-1370

What it actually does

Unbounded recursive parsing of nested JSON arrays and objects causes stack exhaustion leading to application crash.

Why it matters to the business

Attackers can trigger denial of service against any service using the vulnerable library, resulting in application downtime and degraded availability for users.

How an attack unfolds

An attacker crafts a JSON payload containing excessive levels of nested arrays or objects and submits it to any endpoint or API that processes input with the affected json-smart parser; the recursive descent parser exhausts the call stack and crashes the process. Public exploit code has been available since shortly after disclosure.

How to fix it

Upgrade netplex/json-smart-v2 to commit 08517d2033289386aa97462ce43b986eee928b9f or later; for designate on Ubuntu 16.04 LTS upgrade to package version 1:2.1.0-0ubuntu1 or later. Validate the updated library version is in use and test parsing behavior with deeply nested inputs.

How to confirm the fix worked

Confirm the deployed library version matches or exceeds the listed fixed commits or packages; replay a controlled deeply-nested JSON payload in a test environment and verify the process no longer terminates with stack overflow.

Typical attack path

1. Identify an application endpoint or service that accepts and parses untrusted JSON using the vulnerable library
2. Generate a deeply nested JSON structure exceeding typical stack limits
3. Transmit the payload via HTTP, API call, or other supported input channel
4. Observe service crash or unresponsiveness confirming successful denial of service

How to detect it

Review application and web server logs for sudden process terminations or out-of-memory/stack overflow errors coinciding with JSON parsing requests; correlate with unusual request sizes or patterns containing repeated opening brackets.

What your security team should do

• Prioritize upgrade of all instances of json-smart-v2 and dependent packages to the fixed versions within normal change windows
• Add input-size or nesting-depth limits at the application or WAF layer until upgrades are complete
• Include the library in regular dependency scanning and SBOM processes to prevent regression