CyberRota Analysis
AI-GeneratedVersions 1.5.0 through 1.7.19 of cJSON are vulnerable due to an incorrectly-resolved name or reference issue in the decode_pointer_inplace() function, which allows unauthenticated attackers to manipulate JSON Patch operations. By supplying crafted JSON Pointer escape sequences, attackers can corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that utilize JSON Patch for data modification. Developers and organizations using affected cJSON versions should prioritize patching to mitigate the risk of unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.