Improper Handling of Syntactically Invalid Structure Affecting ujson package, versions [,5.4.0)
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-UJSON-2942122
- published 6 Jul 2022
- disclosed 6 Jul 2022
- credit JustAnotherArchivist, the-bumble
Introduced: 6 Jul 2022
CVE-2022-31116 Open this link in a new tabHow to fix?
Upgrade ujson to version 5.4.0 or higher.
Overview
ujson is an Ultra fast JSON encoder and decoder for Python
Affected versions of this package are vulnerable to Improper Handling of Syntactically Invalid Structure due to incorrect decoding of JSON strings that contain escaped surrogate characters that are not part of a proper surrogate pair. This allows data corruption, and therefore impacts the integrity of the target application, as well as potentially impacting the availability of dictionary data.
PoC:
>>> ujson.loads(r'"\uD800"')
' '
>>> ujson.loads(r'"\uD800hello"')
'hello'
# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'
# A pair of surrogates with additional non-surrogate characters pair up in spite of being invalid.
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀