Description
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which parses it before signature checks, overflowing heap allocations and crashing the server.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
grunfink snac2
Default version status: unaffected
0 to < 2.93affected
References
- https://nullenvk.pl/posts/02-snac2-json ↗
- https://gist.github.com/nullenvk/2bf288e2d34cb3d4b7143e61dbf7d90b ↗
- https://codeberg.org/grunfink/snac2/src/tag/2.92/xs_json.h#L283-L285 ↗
- https://codeberg.org/grunfink/snac2/commit/ec2c5c2046e0381bc942ec5d0d05ec861fe377e7 ↗
- https://codeberg.org/grunfink/snac2/releases/tag/2.93 ↗
- https://codeberg.org/grunfink/snac2 ↗
- https://www.vulncheck.com/advisories/snac2-before-2.93-heap-based-buffer-overflow-via-json-parser-xs-json-load-lexer ↗