CVE-2024-31755

What it actually does

Segmentation violation triggered via the second parameter to cJSON_SetValuestring in cJSON.c, resulting in memory corruption and process crash.

Why it matters to the business

Disrupts Caldera-based adversary emulation and red-team operations by causing unexpected service termination when processing certain JSON data.

How an attack unfolds

An attacker supplies crafted input that reaches cJSON_SetValuestring with a malicious second argument, forcing a segmentation fault and denial of service.

How to fix it

Update mitre/caldera to commit a1f6a919cbee846412fb273d357ccf7eea7de800 or later; rebuild and redeploy affected instances.

How to confirm the fix worked

Confirm the running binary or source tree contains commit a1f6a919cbee846412fb273d357ccf7eea7de800; re-test cJSON_SetValuestring paths with previously crashing inputs.

Typical attack path

1. Identify an endpoint or API in Caldera that accepts JSON input processed by cJSON
2. Craft a payload that triggers the second parameter of cJSON_SetValuestring with invalid data
3. Send the payload to induce segmentation violation and crash the process
4. Repeat to maintain denial of service against emulation services

How to detect it

Review Caldera application and system logs for unexpected segmentation faults or process terminations around JSON handling routines; correlate with inbound requests containing JSON payloads.

What your security team should do

• Upgrade all Caldera deployments to the fixed commit immediately
• Monitor for service restarts or crashes in Caldera logs
• Restrict untrusted JSON input sources until patched
• Review downstream dependents for similar cJSON usage