CVE-2024-21907
CVE-2024-21907 allows for a potential Denial of Service (DoS) attack in Newtonsoft.Json. By sending specifically crafted data to the JsonConvert.DeserializeObject method, an attacker can trigger a StackOverflow exception, crashing the application.
CVE-2024-21907 is a vulnerability in Newtonsoft.Json before version 13.0.1 that can lead to a Denial of Service. An attacker exploits this vulnerability by sending crafted data to JsonConvert.DeserializeObject, causing a StackOverflow. Although the CVSS score is 7.5, the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a lower immediate risk compared to critical vulnerabilities with SVRS scores above 80. However, it's important to note that even with a lower SVRS, the potential for remote unauthenticated attackers to cause DoS makes patching this vulnerability essential to ensure system stability. The risk depends on how Newtonsoft.Json is implemented, but due to the widespread use of the library, it must be monitored and carefully addressed.
Description
CVE-2024-21907 is a mishandling of exceptional conditions vulnerability in Newtonsoft.Json before version 13.0.1. Crafted data passed to the JsonConvert.DeserializeObject method can trigger a StackOverflow exception, leading to a denial of service. Unauthenticated remote attackers may exploit this vulnerability to cause a denial of service condition.
Key Insights
- SVRS Score: 30 indicates a moderate risk, requiring attention and monitoring.
- Exploit Status: Active exploits have been published.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies
- Update Newtonsoft.Json to version 13.0.1 or later.
- Implement input validation to prevent crafted data from being passed to the JsonConvert.DeserializeObject method.
- Use a web application firewall (WAF) to block malicious requests.
- Monitor logs for suspicious activity and take appropriate action.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.