-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service in the JSON-Java library, caused by a parser bug that allows a specially crafted JSON string with embedded null characters to be misinterpreted. This misinterpretation can lead to a JSONObject being used as a key within another JSONObject. When this JSONObject key is stringified (which can happen during the object's construction when adding the key to the internal map), it results in an exponential increase in the string's length due to escaping of characters like backslashes, ultimately causing an OutOfMemoryError.
The analysis of the provided patch (commit 60662e2f8384d3449822a3a1179bfe8de67b55bb) shows that the fix is applied within the org.json.JSONObject.<init>(JSONTokener x) constructor. Specifically, a check if (x.end()) is added to ensure that if the JSONTokener reaches an end state prematurely (e.g., due to a null character), an error is thrown before the parser attempts to process a key in an invalid state. This directly addresses the root cause of the parsing flaw.
Therefore, org.json.JSONObject.<init>(org.json.JSONTokener) is identified as a vulnerable function because it contained the flawed parsing logic.
Additionally, the public constructor org.json.JSONObject.<init>(String source) is identified as vulnerable because it is the primary entry point that accepts the malicious string input and initiates the vulnerable parsing process by calling org.json.JSONObject.<init>(org.json.JSONTokener). The Proof of Concept explicitly uses this constructor.
Both functions would be key runtime indicators during the exploitation of this vulnerability. The OutOfMemoryError, as described, occurs 'inside new JSONObject', implicating these constructors.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.json:json | maven | <= 20230618 | 20231013 |
Ongoing coverage of React2Shell