Ruby JSON has a format string injection vulnerability

Vulnerability

Overview

A format string injection vulnerability exists in the Ruby JSON gem, affecting versions 2.14.0 up to, but not including, the patched versions 2.15.2.1, 2.17.1.2, and 2.19.2 [1][3]. The flaw is triggered specifically when the allow_duplicate_key: false parsing option is used to process user-supplied JSON documents. The root cause is that user-controlled input is improperly handled as a format string, allowing an attacker to inject formatting directives.

Exploitation

The vulnerability is exploitable by providing a crafted JSON document that, when parsed with allow_duplicate_key: false, causes the Ruby JSON parser to interpret parts of the input as format string specifiers [1][3]. No authentication is required, and the attack vector is over the network, with low attack complexity and no special privileges needed [3]. The attacker only needs to supply a malicious JSON payload to an application that uses the vulnerable parsing option.

Impact

Successful exploitation can lead to denial of service (DoS) or information disclosure [1][3]. A DoS attack could crash the Ruby process or consume excessive resources, while information disclosure might leak sensitive memory contents, such as internal data or credentials, through the format string processing.

Mitigation

The issue has been patched in JSON gem versions 2.15.2.1, 2.17.1.2, and 2.19.2 [1][4]. Users are strongly advised to upgrade to one of these patched versions. No workarounds have been publicly documented beyond updating the gem.