CyberRota Analysis
AI-GeneratedThe cJSON library, up to version 1.7.19, is vulnerable due to improper handling of JSON Patch operations, allowing an attacker to manipulate the target document even when the patch is reported as failed. This non-atomic application can lead to unintended data loss, as addressable members may be deleted during the process. Developers and organizations utilizing cJSON for JSON processing should prioritize this vulnerability to prevent potential data integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.
Related CVEs
Other vulnerabilities affecting the same vendor(s)