CVE-2024-53848

Cache confusion in check-jsonschema allows attackers to replace cached JSON schemas, bypassing validation. Upgrade to 0.30.0.

• CVSS 7.1
• CWE-349
• Design Defects
• Remote

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected. This issue has been patched in version 0.30.0. All users are advised to upgrade. A few workarounds exist: 1. Users can use `–no-cache` to disable caching. 2. Users can use `–cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) 3. Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema –schemafile ./schema.json`

CVE

CVE-2024-53848

CWE

CWE-349

CVSS base score

7.1

Published

2024-11-29

OWASP

A03 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Data Theft

Affected component

check-jsonsc

Fixed by upgrading

Yes

Solution

Upgrade to version 0.30.0 or higher.

import os
import hashlib
import requests
from jsonschema import validate

CACHE_DIR = ".check-jsonschema-cache"

def get_schema(schema_url):
    os.makedirs(CACHE_DIR, exist_ok=True)

    cache_filename = os.path.join(CACHE_DIR, os.path.basename(schema_url))

    if os.path.exists(cache_filename):
        with open(cache_filename, "r") as f:
            schema = f.read()
    else:
        response = requests.get(schema_url)
        response.raise_for_status()
        schema = response.text
        with open(cache_filename, "w") as f:
            f.write(schema)

    return schema


def validate_json(json_data, schema_url):
    schema = get_schema(schema_url)
    try:
      import json
      schema_data = json.loads(schema)
      validate(instance=json_data, schema=schema_data)
      return True
    except Exception as e:
      return False


schema_url = "https://example.evil.org/schema.json"

json_data = {"a": 1}

validation_result = validate_json(json_data, schema_url)  
print(f"Validation result: {validation_result}")

import os
import hashlib
import requests
import json
from jsonschema import validate
from urllib.parse import urlparse

CACHE_DIR = ".check-jsonschema-cache"
TRUSTED_HOSTS = ["example.com"]

def get_schema(schema_url):
    os.makedirs(CACHE_DIR, exist_ok=True)

    parsed_url = urlparse(schema_url)
    if parsed_url.hostname not in TRUSTED_HOSTS:
        raise ValueError(f"Untrusted schema URL: {parsed_url.hostname}")

    cache_filename = os.path.join(CACHE_DIR, os.path.basename(schema_url))
    schema = None

    if os.path.exists(cache_filename):
        with open(cache_filename, "r") as f:
            schema = f.read()
    else:
        try:
            response = requests.get(schema_url, timeout=10)
            response.raise_for_status()

            schema = response.text
            with open(cache_filename, "w") as f:
                f.write(schema)
        except requests.exceptions.RequestException as e:
            raise ValueError(f"Error fetching schema: {e}")

    return schema

def validate_json(json_data, schema_url):
    try:
        schema = get_schema(schema_url)
        schema_data = json.loads(schema)
        validate(instance=json_data, schema=schema_data)
        return True
    except json.JSONDecodeError as e:
        print(f"Invalid JSON in schema: {e}")
        return False
    except ValueError as e:
        print(f"Validation error: {e}")
        return False
    except Exception as e:
        print(f"Unexpected error: {e}")
        return False


schema_url = "https://example.com/schema.json"
json_data = {"a": 1}

validation_result = validate_json(json_data, schema_url)  
print(f"Validation result: {validation_result}")

https://example.evil.org/schema.json

@misc{vaitp:cve202453848,
  title        = {{Cache confusion in check-jsonschema allows attackers to replace cached JSON schemas, bypassing validation. Upgrade to 0.30.0.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-53848},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-53848/}}
}