Penetration Test Report (Bishop Fox): C Plus Plus Alliance   Boost JSON Security Assessment 2020   Assessment Report   20210317

ASSESSMENT REPORT
THE C PLUS PLUS ALLIANCE, INC.
BOOST.JSON SECURITY ASSESSMENT 2021
MARCH 17, 2021
This engagement was performed in accordance with the Statement of Work, and the procedures were limited
to those described in that agreement. The findings and recommendations resulting from the assessment are
provided in the attached report. Given the time-boxed scope of this assessment and its reliance on client-
provided information, the findings in this report should not be taken as a comprehensive listing of all security
issues.
This report is intended solely for the information and use of The C Plus Plus Alliance, Inc.
Bishop Fox Contact Information:
[PII_REDACTED]
contact@bishopfox.com
8240 S. Kyrene Road
Suite A-113
Tempe, AZ 85284
2021/03/17 2
TABLE OF CONTENTS
Table of Contents.................................................................................................................... 3
Executive Report ..................................................................................................................... 4
Project Overview.................................................................................................................................. 4
Approach .............................................................................................................................................. 4
Assessment Report ................................................................................................................. 9
Hybrid Application Assessment ........................................................................................................ 9
Type representation ............................................................................................................... 9
Appendix A — Measurement Scales ................................................................................... 11
Finding Severity .................................................................................................................................11
Appendix B — Test Plan ....................................................................................................... 12
2021/03/17 3
EXECUTIVE REPORT
Project Overview
FINDING COUNTS
The C Plus Plus Alliance, Inc. engaged Bishop Fox to assess the 1 Low
security of the Boost.JSON C++ library. The following report
details the findings identified during the course of the 1 Total finding
engagement, which started on February 8, 2021.
Goals SCOPE
Boost.JSON library v.1.75.0
• Ensure the Boost.JSON parser is secure against untrusted
Commit:
inputs and that undefined behavior and crashing are not
edbf86641b7217676eceb
possible 6582ee486e31bb42745
• Review the container, as in theory it could be the target of
DATES
algorithmic complexity attacks
02/08/2021
• Look for buffer overflows and other vulnerabilities in the Kickoff
Boost.JSON parser
02/08/2021 – 02/23/2021
• Thoroughly fuzz the Boost.JSON library
Active testing
• Provide best practices for users of the Boost.JSON library
03/17/2021
Report delivery
Approach
The assessment team conducted a hybrid application assessment of the Boost.JSON library.
Bishop Fox’s hybrid application assessment methodology leverages real-world attack
techniques of application penetration testing in combination with targeted source code
review. These full-knowledge assessments begin with automated scans of the deployed
application and source code. Next, analyses of the scan results are combined with manual
review to thoroughly identify potential application security vulnerabilities. In addition, the
team conducts a review of the application architecture and business logic to locate any
design-level issues. Finally, the team performs manual exploitation and review of these
issues to validate the findings.
For this engagement, the team made use of the current fuzzing implementation, which the
repository used with LLVM’s AddressSanitizer (ASAN) and UndefinedBehaviorSanitizer
(UBSAN) by running the fuzzing tests for extended periods of time. In conjunction with
LLVM, the team made use of alternate fuzzers such as AFL++ with guidance from a symbolic
execution framework, angr, to help extend coverage that was not provided by LLVM. The
2021/03/17 4
use of these fuzzers in conjunction with manual review helped the team to explore the core
functionality of the library and to identify memory management or corruption issues.
Strategic Approach
Fuzzing Strategy
One of the assessment goals was to identify vulnerabilities that can occur when Boost.JSON
parses JSON input and serializes to JSON output. The assessment team found that the
majority of Boost.JSON fuzzing programs and examples were set up in a similar fashion to
tackle these ideas. This allowed the team to deploy the already-existing fuzzing harnesses
into other fuzzing platforms for extended periods of time. The team modified the examples
by adding a thread for executing AFL++ in persistent mode. Further modifications allowed
harnesses to run in LibFuzz, AFL++, and AFL_IJON. All were guided with angr for further
code coverage.
To fuzz the JSON parser, the team created a fuzzing harness based on the harnesses that
already existed in the fuzzing folder within the Boost.JSON repository. This harness, based
on the fuzzer_parse, fuzzer_basic_parser, and fuzzer_parser files in the fuzzing
folder, was instrumented with the custom clang compiler afl-clang-fast++ to assist
with fuzzing the library with AFL. Parameters such as AFL_PERSISTENT were also
introduced into the program to speed up fuzzing cycles.
The harnesses read in content from files generated by the fuzzer, then parse, stream parse,
and validate the given JSON. These programs run until the number of identified paths stops
growing and the number of completed cycles matches the paths discovered. The use of
angr gave AFL the ability to find more "interesting" paths and avoided a "stuck" state,
thereby allowing further code coverage within the library. The team determined that the
fuzzing conducted was sufficient to produce reliable results in the time provided.
Static Source Code Analysis
The assessment team used Checkmarx against the Boost.JSON codebase for additional
coverage and to supplement the fuzzing and manual code review process. Checkmarx
flagged 219 issues. However, after review, the team determined that these were negligible
and irrelevant to the goals of the engagement.
The team moved forward to check for known bad code practices, such as the use of
unconstrained buffers and the use of unsafe execution of calls to the system. The library
used innovative practices for dynamic memory management and properly deallocated
memory created in the JSON objects. Since this library needed only basic functionality, it did
not make any calls risky to the OS such as execve or system function.
A benefit of the Boost.JSON library, as of 1.75.0, is its limited list of dependencies to the
Boost Library Collection. The only dependencies found were to boost/system,
boost/assert, boost/exception, boost/container, and boost/align. This helped to
2021/03/17 5
strengthen the integrity of Boost.JSON, since any potential future vulnerabilities found in
addition to the Boost Library Collection would not affect the Boost.JSON library. If
vulnerabilities are found in the general Boost Library Collection, it is recommended to
ensure that boost/system, boost/assert, boost/exception, boost/container,
and boost/align have not been affected.
Investigations of the current bugs and issues posted to the repository indicated that they
were negligible to the integrity of the Boost.JSON library. The team built out small programs
based on the bugs described and noted the success or failures of each. No failures were
found, and the bugs were negligible to the operation and did not cause any undefined
behavior. This suggests that the bugs either were patched or had occurred but could not be
reproduced by the team. Any bugs that are already patched should b