CVE-2020-10663: Ruby JSON Gem Object Creation Vulnerability

CVE-2020-10663 Overview

CVE-2020-10663 is an Unsafe Object Creation Vulnerability affecting the JSON gem through version 2.2.0 for Ruby, as well as Ruby versions 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5. This vulnerability allows attackers to create malicious objects within the Ruby interpreter through crafted JSON parsing operations, with application-dependent adverse effects. The vulnerability is similar to the earlier CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby.

Critical Impact

Exploitation enables attackers to create arbitrary objects within the Ruby interpreter during JSON parsing, potentially leading to unauthorized data manipulation or application compromise depending on the target application's implementation.

Affected Products

• JSON gem through 2.2.0 for Ruby
• Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5
• Fedora 30 and 31
• openSUSE Leap 15.1
• Debian Linux 8.0 and 10.0
• Apple macOS 11.0.1

Discovery Timeline

• April 28, 2020 - CVE-2020-10663 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-10663

Vulnerability Analysis

This vulnerability exists in the JSON parsing functionality of the Ruby JSON gem. When processing specially crafted JSON input, the parser can be manipulated to instantiate arbitrary Ruby objects within the interpreter context. This unsafe object creation bypasses normal object instantiation controls and can lead to security compromises depending on how the application processes the resulting objects.

Unlike its predecessor CVE-2013-0269, this vulnerability does not depend on garbage collection timing or behavior. Instead, it exploits fundamental aspects of how the JSON gem handles type information during deserialization. The impact is highly dependent on the application context—in some applications, this could lead to information disclosure, data corruption, or denial of service.

The vulnerability is classified under CWE-20 (Improper Input Validation), reflecting the core issue of insufficient validation during the JSON parsing process.

Root Cause

The root cause lies in how the JSON gem processes JSON data containing type information. The gem's parsing methods fail to properly validate and restrict object creation, allowing attackers to specify arbitrary class types that will be instantiated during parsing. This improper input validation enables the creation of objects that the application developer did not intend to be created through JSON deserialization.

Attack Vector

The attack is conducted over the network by sending maliciously crafted JSON payloads to Ruby applications that parse user-controlled JSON data. An attacker can construct JSON documents that, when parsed using vulnerable versions of the JSON gem, cause the Ruby interpreter to create arbitrary objects.

The exploitation mechanism involves embedding type specifiers within JSON data that the parser interprets as instructions to create specific Ruby objects. The attack requires no authentication and has low complexity, as it only necessitates the ability to send crafted JSON to a vulnerable parsing endpoint. The specific impact depends on what objects are created and how the application handles them.

Detection Methods for CVE-2020-10663

Indicators of Compromise

• Unexpected Ruby object instantiation in application logs during JSON parsing operations
• Anomalous JSON payloads containing unusual type specifiers or class references
• Application errors or exceptions related to unexpected object types after JSON processing
• Unusual memory consumption patterns during JSON parsing operations

Detection Strategies

• Monitor JSON parsing operations for payloads containing json_class or similar type specification keys that could trigger object creation
• Implement application-level logging to track all objects instantiated during JSON deserialization
• Deploy runtime application self-protection (RASP) solutions capable of detecting unsafe deserialization patterns
• Use SentinelOne Singularity to monitor for suspicious Ruby process behavior and unexpected object instantiation

Monitoring Recommendations

• Audit all Ruby applications for use of vulnerable JSON gem versions (2.2.0 and earlier)
• Implement centralized logging for JSON parsing activities across Ruby-based services
• Set up alerts for failed JSON parsing attempts that may indicate exploitation probing
• Monitor for unusual process spawning or file system access following JSON processing

How to Mitigate CVE-2020-10663

Immediate Actions Required

• Update the JSON gem to version 2.3.0 or later, which includes the security fix
• Upgrade Ruby to patched versions: 2.4.10, 2.5.8, 2.6.6, or 2.7.1 and later
• Audit applications to identify all instances of JSON parsing with user-controlled input
• Review the Ruby CVE-2020-10663 Advisory for official guidance

Patch Information

The vulnerability has been addressed by the Ruby development team in updated versions of both the JSON gem and Ruby itself. Organizations running affected versions should update to the following:

• JSON gem: Update to version 2.3.0 or later
• Ruby 2.4.x: Update to 2.4.10 or later
• Ruby 2.5.x: Update to 2.5.8 or later
• Ruby 2.6.x: Update to 2.6.6 or later
• Ruby 2.7.x: Update to 2.7.1 or later

Distribution-specific patches are available through Debian Security Advisory DSA-4721, Fedora Package Announcements, and openSUSE Security Announcements. Apple has addressed this in macOS updates as documented in their support article HT211931.

Workarounds

• Restrict JSON parsing to use the JSON.parse method with the create_additions: false option to disable object creation during parsing
• Implement input validation to sanitize JSON data before parsing, removing potentially dangerous type specifiers
• Use JSON schema validation to ensure incoming JSON conforms to expected structures
• Consider using alternative JSON parsing libraries that do not support automatic object instantiation

# Example: Safe JSON parsing in Ruby with create_additions disabled
# Add this to your Ruby application code where JSON is parsed

# Gemfile update
gem 'json', '>= 2.3.0'

# Safe parsing configuration
# Use JSON.parse with create_additions: false
# JSON.parse(user_input, create_additions: false)