Penetration Test Report (X41 D-Sec): X41 OSTIF simplejson CodeReview 2023 04 18

SourceCodeAuditonsimplejson
forOpenSourceTechnologyImprovementFund(OSTIF)
FinalReportandManagementSummary
2023-04-18
PUBLIC
X41 D-SEC GmbH
Krefelderstr. 123
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
OrganizedbytheOpenSourceTechnologyImprovementFund
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
Revision Date Change Author(s)
1 2023-03-29 FinalReportandManagement E.Sesterhenn,J.M.,L.Gommans
Summary
2 2023-04-13 PublicRelease L.Gommans
3 2023-04-18 Minorclarifications L.Gommans
X41D-SecGmbH PUBLIC Page1of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 FindingsOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4 Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.5 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 RatingMethodologyforSecurityVulnerabilities 11
3.1 CommonWeaknessEnumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4 Results 13
4.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5 AboutX41D-SecGmbH 30
A Fuzzing 32
A.1 DifferentialFuzzing-python-afl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
A.2 DifferentialFuzzing-pythonfuzz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
A.3 DifferentialFuzzing-atheris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
A.4 DifferentialFuzzing-pythonfuzz/orjson . . . . . . . . . . . . . . . . . . . . . . . . 36
X41D-SecGmbH PUBLIC Page2of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund(OSTIF)
Name simplejson
Type PythonLibrary
Version Version3.18.4
Engagement
Type SourceCodeAudit
Consultants 3:EricSesterhenn,J.M.,andLucGommans
EngagementEffort 12person-days,2023-03-19to2023-03-24
Totalissuesfound 3
Critical - 0
High - 0
CWE-400(1) CWE-20(1)
Medium - 1
Low - 2
CWE-772(1)
None - 9
0 1 2 3 4 5 6 7 8 9
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
1 Executive Summary
InMarch2023,X41D-SecGmbHperformedasourcecodeauditagainstsimplejsontoidentify
vulnerabilitiesandweaknessesinthelibrary.
AtotalofthreevulnerabilitieswerediscoveredduringthetestbyX41.Nonewereratedashaving
a critical or high severity, one as medium, and two as low. Additionally, nine issues without a
directsecurityimpactwereidentified.
Low - 2
Medium - 1
Figure1.1:IssuesandSeverity
simplejsonisalibrarytoparseJSONdatainPython.Ithasasimilarinterfacetothebuilt-inJSON
parserbutsupportsolderversionsofPythonincluding2.5. AlongsideapurePythonimplemen-
tation,italsoimplementspartsofthecodeinCforperformancereasons. Vulnerabilitiesinthe
librarycouldallowanattackertocompromisesoftwarewhichusesJSONparsingforuntrusted
input,asisnotuncommonfordatainterfaces.
X41D-SecGmbH PUBLIC Page4of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
Inasourcecodeaudit,allinformationaboutthesystemisavailable. Thetestwasperformedby
threeexperiencedsecurityexpertsbetween2023-03-19and2023-03-24.
ThemostsevereissuediscoveredrelatestoasecurityfixfornewerPythonversionsnotbeing
implemented in simplejson. This allows an attacker to cause a denial of service by specifying
anuncommonlylargenumberintheJSONdata. Besidestakingdownnetworkedservices, one
scenariocouldbeblockingaJSON-basedupdatertokeepusersonanoldversionofsoftwarefor
which a patch was recently released. Because the software hangs instead of producing a clear
errormessage,themaliciousnatureofthesituationcangounnoticed.
In addition, the Python implementation parses character formats which are not in compliance
withspecification. Thisisduetotheuseofageneral-purposeintegerconversionfunctionwith-
outvalidatingtheinputbeforehand. Anattackermightbeabletoexploitasituationwherethe
validatorusessimplejsonandpassesallchecks,butthencrashesaback-endsystemduetothe
invalidJSONdata.
Amongtheinformationalnotes,hardeningcouldbeappliedbysigningthecodechangeswitha
developer’sprivatekey.X41hadnoinsightintotheGitHubaccountororganizationsettingsand
thus recommends to review these in a separate audit. X41 furthermore recommends to apply
additionalrestrictionstountrustedinputdata.
Overall,thelackofhigh-severityissuesbeingidentifiedatteststothematurityofthisprojectand
codebase,butfurtherhardeningcanbeappliedonatechnicalandgeneralorganizationallevel.
X41D-SecGmbH PUBLIC Page5of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
2 Introduction
X41 reviewed the source code of simplejson which lets users serialize and deserialize JSON1
objects.
SimplejsonisconsideredsensitivebecauseoftenJSONdataisconsideredtobeuntrustedinput.
Thelibraryisusedbyvariousprojectsandanysecurityissueswillthereforeaffectawiderange
ofsystems. Accordingtopypistats.org2, thedailynumberofdailydownloadsfortheprojectis
overhalfamillion,ofwhichabout51000arebysystemswithanoldPythonversion.
AttackerscouldtrytoattacksimplejsonbyusingspeciallycraftedJSONinputinordertocreate
unexpected deserialized objects, which might then be used to attack software relying on sim-
plejson. Likewise, attackers could try to use specially crafted Python object attributes in order
tocreateunexpectedserializedJSON, hopingtoabusesoftwarethatreliesontheserialization.
Furthermore,attackerscouldalsotrytocausefailuresinsimplejson,causingunexpectederrors
or rendering the software relying on simplejson unavailable. Additionally, attackers might try
to trigger memory safety violations in the C parts that allow for information leaks or memory
corruptions.
2.1 Methodology
ThereviewwasbasedonasourcecodereviewofthePythonandCsourcecode.
AmanualapproachforpenetrationtestingandforcodereviewisusedbyX41. Thisprocessis
supportedbytoolssuchasstaticcodeanalyzersandindustrystandardwebapplicationsecurity
tools3.
X41adherestoestablishedstandardsforsourcecodereviewingandpenetrationtesting. These
1JavaScriptObjectNotation
2https://pypistats.org/packages/simplejson
3https://portswigger.net/burp
X41D-SecGmbH PUBLIC Page6of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
areinparticulartheCERTSecureCoding4 standardsandtheStudy-APenetrationTestingModel5
oftheGermanFederalOfficeforInformationSecurity.
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
4https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
5https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page7of37
SourceCodeAuditonsimplejson OpenSourceTechnologyImprovementFund(OSTIF)
2.2 Findings Overview
DESCRIPTION SEVERITY ID REF
InvalidHandlingofBrokenUnicodeEscapeSequences LOW SJ-PT-23-01 4.1.1
MissingReferenceCountDecrease LOW SJ-PT-23-02 4.1.2
QuadraticNumberParsing MEDIUM SJ-PT-23-03 4.1.3
BrokenErrorDisplay NONE SJ-PT-23-100 4.2.1
UnusedImport NONE SJ-PT-23-101 4.2.2
UnusedTuple-relatedFunctionArguments NONE SJ-PT-23-102 4.2.3
UnusedFunctionArgument_one_shot NONE SJ-PT-23-103 4.2.4
TypeHintsNotUsed NONE SJ-PT-23-104 4.2.5
DeprecatedPythonVersionsSupported NONE SJ-PT-23-105 4.2.6
UnsignedGitCommits NONE SJ-PT-23-106 4.2.7
InfinityandNaN NONE SJ-PT-23-107 4.2.8
SupportofDuplicateKeyNames NONE SJ-PT-23-108 4.2.9
Table2.1:Security-RelevantFindings
2.3 Scope
Theauditwasperformedagainstthemostrecentsimplejsonversion,3.18.46.Thecodecontained
around30