Stack Overflow in JSON RPC Server
M
Monero
Submitted None
Actions:
Reported by
talko
Vulnerability Details
Technical details and impact analysis
**Summary:**
There is a stack overflow bug in json_parser when parsing nesting objects.
**Description:**
Monero's json parser (handled by epee libraries) doesn't check object tree depth while parsing
## Steps To Reproduce:
Up the service
```bash
> monerod
```
run
```bash
> python2 poc.py
```
backtrace
```
SUMMARY: AddressSanitizer: stack-overflow /home/bug/monero/contrib/epee/include/storages/portable_storage_from_json.h:47 in void epee::serialization::json::run_handler<epee::serialization::portable_storage>(epee::serialization::portable_storage::hsection, __gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >&, __gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, epee::serialization::portable_storage&)
Thread T6 created by T0 here:
#0 0x7fe374230a51 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:202
#1 0x7fe371b463db in boost::thread::start_thread_noexcept(boost::thread_attributes const&) (/usr/lib/libboost_thread.so.1.67.0+0x133db)
==4088==ABORTING
```
Tested on
```bash
> monerod --version
Monero 'Lithium Luna' (v0.12.3.0-master-0dddfeac)
```
## Supporting Material/References:
poc.py > Malicious json rpc request
## Impact
Attacker could run arbitrary code
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Stack Overflow