Denial-of-Service in Jackson Databind via Deeply Nested JSON

Executive Summary

The vulnerability exists in jackson-databind versions from 2.13.0 until 2.14.0. It occurs when an attacker sends deeply nested JSON data (thousands of levels) that is read as a JsonNode using ObjectMapper.readTree() and then written out using JsonNode.toString(). This process can consume a significant amount of system resources even with relatively small requests, potentially leading to a Denial-of-Service (DoS) condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial-of-Service (DoS) condition. When an attacker sends deeply nested JSON data, the system may consume excessive resources processing these requests, which can degrade performance or make the service unavailable to legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade jackson-databind to version 2.14.0 or later, where the issue is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing if your system running jackson-databind versions from 2.13.0 up to but not including 2.14.0 is vulnerable to denial-of-service caused by deeply nested JSON structures.

A practical way to detect it is to send or process a JSON payload with very deep nesting (thousands of nested arrays or objects) and observe if the service experiences a StackOverflowError or significant resource consumption when parsing and serializing the JSON using ObjectMapper.readTree() and JsonNode.toString().

For example, you can create a deeply nested JSON string and use a Java test program or script to parse and serialize it with jackson-databind to see if it triggers the issue.

• Use a Java snippet to parse deeply nested JSON with ObjectMapper.readTree() and call toString() on the resulting JsonNode.
• Monitor your application logs or runtime for StackOverflowError or excessive CPU/memory usage during such operations.

There are no specific network commands provided in the resources, but crafting and sending deeply nested JSON payloads to the affected service endpoints that use jackson-databind can help detect the vulnerability.

Useful 0 Not Useful 0