JSON injections occur when an application builds a JSON-formatted string from user input without prior validation or sanitation. In such a case, a
tainted user-controlled value can tamper with the JSON string content. Especially, unexpected arbitrary elements can be inserted in the corresponding
JSON object. Those modifications can include:
- Adding additional keys to a JSON dictionary.
- Changing values types.
- Adding elements in an array.
A malicious user-supplied value can perform other modifications depending on where and how the constructed data is later used.
What is the potential impact?
The consequences of a JSON injection attack into an application vary greatly depending on the application’s logic. It can affect the application
itself or another element if the JSON string is used for cross-component data exchange. For this reason, the actual impact can range from benign
information disclosure to critical remote code execution.
Information disclosure
An attacker can forge an attack payload that will modify the JSON string so that it will become syntactically incorrect. In that case, when the
data is later used, the parsing component will raise a technical error. If displayed back to the attacker or made available through log files, this
technical error may disclose sensitive business or technical information.
This scenario, while in general the less severe one, is the most frequently encountered. It can combine with any other logic-dependant threat.
Privilege escalation
An application that would rely on JSON to store or propagate users' authentication levels and roles would be under threat of privilege escalations.
Indeed, an attacker could tamper with the permissions storage object to insert arbitrary roles or privileges.
While highly specific, similar issues can be faced in the following situations:
- An application builds JSON payloads for HTTP requests.
- An application builds JWT from user input.
Code execution
An application might build objects based on a JSON serialization string. In that case, an attacker that would exploit a JSON injection could be
able to alter the serialization string to modify the corresponding object’s properties.
Depending on the deserialization process, this might allow instantiating arbitrary objects or objects with sensitive properties altered. This can
lead to arbitrary code being executed in the same way as a deserialization injection vulnerability.
