CVE-2023-53154

What it actually does

The vulnerability is a heap-based buffer over-read in parse_string when cJSON_ParseWithLength processes JSON such as {"1":1 with no trailing newline.

Why it matters to the business

Applications that embed the library may crash or disclose memory contents when handling untrusted JSON, disrupting services and increasing risk of data exposure.

How an attack unfolds

An attacker supplies a crafted JSON fragment lacking a trailing newline to any code path that calls cJSON_ParseWithLength, causing the parser to read past the allocated buffer.

How to fix it

Upgrade davegamble/cjson to commit acc76239bee01d8e9c858ae2cab296704e52d916 or release 1.7.18 or newer.

How to confirm the fix worked

Confirm the installed cJSON version is 1.7.18 or later; re-test parsing of newline-free JSON objects to verify the over-read no longer occurs.

Typical attack path

1. Locate an application that uses a vulnerable cJSON build
2. Prepare a minimal JSON object without a trailing newline
3. Invoke cJSON_ParseWithLength with the crafted input
4. Observe crash or memory disclosure from the over-read

How to detect it

Search application and system logs for segmentation faults or abnormal terminations during JSON parsing; inspect any custom wrappers around cJSON_ParseWithLength for error handling gaps.

What your security team should do

• Update the cJSON dependency to the fixed commit across all products
• Audit call sites that use cJSON_ParseWithLength
• Add runtime bounds checks or input sanitization around JSON ingestion
• Include the library in the next scheduled dependency scan