CVE-2024-21907
HIGHNewtonsoft.Json < 13.0.1 - Denial of Service via JsonConvert.DeserializeObject
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-21907. PoCs published by seal-sec-demo-2.
AI-analyzed exploit summary This repository contains a functional PoC demonstrating CVE-2024-21907, a DoS vulnerability in Newtonsoft.Json 12.0.2 caused by deep recursion during deserialization. The PoC includes a .NET 7 web application that processes user input through Newtonsoft.Json, triggering a StackOverflowException when deeply nested JSON is provided.
Description
Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Exploits (1)
This repository contains a functional PoC demonstrating CVE-2024-21907, a DoS vulnerability in Newtonsoft.Json 12.0.2 caused by deep recursion during deserialization. The PoC includes a .NET 7 web application that processes user input through Newtonsoft.Json, triggering a StackOverflowException when deeply nested JSON is provided.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H