CVE-2024-57699

Executive Summary

CVE-2024-57699 is a Denial of Service (DoS) vulnerability in Netplex Json-smart versions 2.5.0 through 2.5.1. The issue arises from an incomplete fix for CVE-2023-1370, where a specially crafted JSON input containing a large number of opening braces { can trigger stack exhaustion. This allows an unauthenticated remote attacker to cause a denial of service by crashing the application or consuming excessive resources. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the ease of exploitation and potential impact on availability. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Java library netplex/json-smart, which is distributed via Maven Central and other Java package repositories. Applications that depend on this library for JSON parsing are at risk. The library is commonly used in Java-based web services, APIs, and data processing pipelines. Organizations should audit their dependencies for affected versions and consider temporary mitigations until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a crafted JSON input is sufficient.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service disruption is likely.

Threat Level: High. The vulnerability is easy to exploit remotely with no authentication, leading to a denial of service. The incomplete fix from CVE-2023-1370 indicates a recurring issue in the library's parsing logic.

Deep Dive & Mechanics

The vulnerability resides in the JSON parsing logic of Json-smart. When the parser encounters a large number of nested opening braces {, it attempts to recursively process the structure. Due to insufficient depth checking (the incomplete fix for CVE-2023-1370), the recursion can exceed the Java call stack limit, causing a StackOverflowError and crashing the JVM. This is a classic stack exhaustion attack.

The incomplete fix for CVE-2023-1370 likely added some depth limit but failed to account for all recursion paths or edge cases. The attacker can craft a JSON payload with thousands of nested { characters (e.g., {"a":{"b":{"c":...}}}) to trigger the exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (Json-smart 2.5.0 - 2.5.1): The parser recursively processes nested objects without adequate depth checks. Example vulnerable snippet (simplified):

public Object parse(String json) {
    // Recursive descent parser
    return parseValue(json, 0);
}
private Object parseValue(String json, int pos) {
    if (json.charAt(pos) == '{') {
        return parseObject(json, pos + 1);
    }
    // ...
}
private Map<String, Object> parseObject(String json, int pos) {
    Map<String, Object> obj = new HashMap<>();
    while (json.charAt(pos) != '}') {
        // Recursively parse nested objects
        String key = parseString(json, pos);
        pos = skipWhitespace(json, pos);
        if (json.charAt(pos) == '{') {
            obj.put(key, parseObject(json, pos + 1)); // Recursive call
        }
        // ...
    }
    return obj;
}

Patched Code (Hypothetical): A proper fix would include a depth counter that throws an exception when exceeded:

private static final int MAX_DEPTH = 1000;
private int depth = 0;

public Object parse(String json) {
    depth = 0;
    return parseValue(json, 0);
}
private Object parseValue(String json, int pos) {
    if (json.charAt(pos) == '{') {
        if (++depth > MAX_DEPTH) {
            throw new ParseException("Max depth exceeded");
        }
        Object result = parseObject(json, pos + 1);
        depth--;
        return result;
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on a target application using Json-smart.

Lab Setup:

1. Set up a vulnerable Java application that uses Json-smart 2.5.0 or 2.5.1 to parse JSON input (e.g., a REST API endpoint).
2. Generate a malicious JSON payload with deep nesting:

   {"a":{"b":{"c":{"d":...}}}} // Repeat thousands of times
   

   Use a script to generate the payload:

   payload = "{" * 10000 + "}" * 10000
   print(payload)
   

3. Send the payload to the target endpoint:

   curl -X POST http://target:8080/api/parse -H "Content-Type: application/json" -d '{"a":{"b":{"c":...}}}'
   

4. Observe the application crash or become unresponsive.

Expected Outcome: The JVM throws a StackOverflowError, and the application stops processing requests.

Blue Team

Detection:

• Monitor for excessive recursion errors in application logs (e.g., StackOverflowError).
• Use network monitoring to detect unusually large JSON payloads with deep nesting.
• Implement input validation to reject JSON with excessive nesting depth (e.g., > 100 levels).

Mitigation:

• Apply a Web Application Firewall (WAF) rule to block requests with deeply nested JSON.
• Use a reverse proxy to limit request body size and nesting depth.
• Upgrade to a patched version of Json-smart when available.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests with JSON payloads containing thousands of nested opening braces {.
• Logs: Java StackOverflowError exceptions in application logs.
• System: High CPU or memory usage on the JVM, followed by process termination.
• File: Temporary files or memory dumps containing deeply nested JSON structures.

Detection Engineering

YARA Rule

rule CVE_2024_57699_JsonSmart_DoS {
    meta:
        description = "Detects JSON payloads with excessive nesting depth targeting Json-smart"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57699"
    strings:
        $json_nesting = /(\{[^}]*){1000,}/  // Matches 1000+ nested braces
    condition:
        $json_nesting
}

Sigma Rule

title: CVE-2024-57699 - Json-smart Stack Exhaustion DoS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with deeply nested JSON payloads targeting Json-smart
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: "POST"
        http.content_type: "application/json"
        http.body|contains: "{{"  // Multiple opening braces
    condition: selection
falsepositives:
    - Legitimate deeply nested JSON from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-57699 - Json-smart Stack Exhaustion DoS"; flow:to_server; content:"POST"; http_method; content:"application/json"; http_content_type; content:"{{"; http_client_body; depth:10000; reference:cve,2024-57699; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Implement input validation to reject JSON payloads with nesting depth exceeding a safe threshold (e.g., 100 levels). This can be done at the application or reverse proxy level.
2. Short-term: Upgrade to a patched version of Json-smart when released. Monitor the vendor's repository for updates.
3. Long-term: Consider using alternative JSON parsing libraries with built-in depth limits, such as Jackson or Gson.
4. Monitoring: Enable logging for StackOverflowError and set up alerts for excessive recursion.
5. WAF: Deploy a Web Application Firewall rule to block requests with deeply nested JSON structures.

Valters IT
DevSecOps & Cyber Threat Intelligence