Miggo Logo

CVE-2024-24786:
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

7.5

CVSS Score

Basic Information

EPSS Score
-
Published
3/6/2024
Updated
11/7/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
google.golang.org/protobufgo< 1.33.01.33.0
google.golang.org/protobuf/encoding/protojsongo< 1.33.01.33.0
google.golang.org/protobuf/internal/encoding/jsongo< 1.33.01.33.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability CVE-2024-24786 describes an infinite loop in protojson.Unmarshal. The provided commit f01a588e5810b90996452eec4a28f22a0afae023 addresses this.

  1. protojson.Unmarshal is identified as the primary affected function based on the vulnerability description. The loop occurs within its execution.
  2. The patch modifies encoding/protojson.(*decoder).skipJSONValue by adding a check for json.EOF with a comment explicitly stating it's to 'Avoid an infinite loop'. This indicates skipJSONValue was directly involved in the loop.
  3. The patch also modifies internal/encoding/json.(*Decoder).Read to correctly handle malformed JSON object closing tokens. The commit message explains this change fixes error handling for inputs like {"":}. Incorrect parsing by Read could lead to the conditions causing the infinite loop in higher-level functions like skipJSONValue or within the broader Unmarshal logic. Therefore, Unmarshal is the entry point, and the loop was caused by issues in its dependent functions skipJSONValue and Decoder.Read when processing specific invalid JSON inputs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** protojson.Unm*rs**l *un*tion **n *nt*r *n in*init* loop w**n unm*rs**lin* **rt*in *orms o* inv*li* JSON. T*is *on*ition **n o**ur w**n unm*rs**lin* into * m*ss*** w*i** *ont*ins * *oo*l*.proto*u*.*ny v*lu*, or w**n t** Unm*rs**lOptions.*is**r*Unk

Reasoning

T** vuln*r**ility *V*-****-***** **s*ri**s *n in*init* loop in `protojson.Unm*rs**l`. T** provi*** *ommit `****************************************` ***r*ss*s t*is. *. `protojson.Unm*rs**l` is i**nti*i** *s t** prim*ry *****t** *un*tion **s** on t**