PT-2024-35950 · Unknown · Check-Jsonschema
Sethmlarson
·
Published
2024-11-29
·
Updated
2024-12-02
·
CVE-2024-53848
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
check-jsonschema versions prior to 0.30.0
Description:
The default cache strategy in check-jsonschema uses the basename of a remote schema as the name of the file in the cache. This naming allows for conflicts, enabling an attacker to insert their own schema into the cache if a user runs check-jsonschema against a malicious schema URL. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected.
Recommendations:
For versions prior to 0.30.0, users can use the
--no-cache flag to disable caching.
For versions prior to 0.30.0, users can use the --cache-filename flag to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema.
For versions prior to 0.30.0, users can explicitly download the schema before use as a local file, as in curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json
Upgrade to version 0.30.0 to patch the issue.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Check-Jsonschema