CVE-2024-39684

What it actually does

Integer overflow in GenericReader::ParseNumber during stream JSON parsing allows memory corruption that can be leveraged for local privilege escalation.

Why it matters to the business

Attackers who trick users into opening a malicious file can obtain elevated privileges on affected systems, potentially compromising forensic tools, log analysis pipelines, or any application using the vulnerable RapidJSON dependency and leading to unauthorized access or tampering.

How an attack unfolds

An attacker creates a specially crafted JSON file that triggers the integer overflow in RapidJSON's number parsing routine. The file is delivered to a victim who opens it with an affected application such as the iris-evtx-module; parsing the file causes the overflow and results in privilege escalation on the local system.

How to fix it

Upgrade dfir-iris/iris-evtx-module to the fixed commit 4e45fc94a31e1ee4641d608a387dfd9f9e68dbca. Rebuild and redeploy any dependent packages or containers that embed the vulnerable RapidJSON code.

How to confirm the fix worked

Confirm the repository commit hash matches 4e45fc94a31e1ee4641d608a387dfd9f9e68dbca, run regression tests with crafted large-number JSON inputs, and verify that parsing no longer produces memory corruption or crashes.

Typical attack path

1. Craft malicious JSON containing values that trigger integer overflow in ParseNumber
2. Deliver the file to the target user via email, download, or shared storage
3. Victim opens the file using the vulnerable application or library
4. RapidJSON parses the stream and the overflow occurs
5. Attacker gains elevated privileges on the host

How to detect it

Review application and system logs for crashes or errors during JSON parsing immediately before privilege-escalation events; correlate file-open activity on untrusted JSON/EVTX sources with subsequent unexpected process or user-context changes.

What your security team should do

• Immediately update the iris-evtx-module dependency to the patched commit
• Scan the software bill of materials for any other RapidJSON usages and apply updates
• Restrict opening of untrusted JSON or EVTX-derived files until patching is complete
• Monitor application logs for parsing errors or unexpected privilege changes