PT-2020-16659 · Lightbend · Play Framework

Published 2020-11-06 · Updated 2022-02-10 · CVE-2020-27196

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Play Framework versions 2.6.0 through 2.8.2

Description An issue was discovered in PlayJava where the body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint causes a StackOverflowError and Denial of Service.

Recommendations For Play Framework versions 2.6.0 through 2.8.2, consider disabling the body parsing of HTTP requests for POST endpoints that do not expect JSON payloads as a temporary workaround until a patch is available. Restrict access to valid POST endpoints to minimize the risk of exploitation. Avoid sending deep JSON structures to valid POST endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-27196

GHSA-H48W-C35P-6M8X

Affected Products

Play Framework

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-27196 · Security Note
• https://playframework.com/security/vulnerability/CVE-2020-27196-DosViaJsonStackOverflow · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h48w-c35p-6m8x · Vendor Advisory
• https://playframework.com/security/vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27196 · Vendor Advisory
• https://github.com/playframework/playframework/pull/10321 · Note
• https://t.me/cvenotify/5254 · Telegram Post
• https://t.me/cvenotify/5245 · Telegram Post
• https://t.me/cibsecurity/15974 · Telegram Post