CVE-2023-3894: Jackson-dataformats-text DOS Vulnerability

CVE-2023-3894 Overview

CVE-2023-3894 is a Denial of Service (DoS) vulnerability affecting the jackson-dataformats-text library's TOML parser. Applications using this library to parse TOML data from user-supplied input are vulnerable to attacks where malicious content can trigger a stack overflow, causing the parser to crash. This vulnerability enables attackers to disrupt service availability by submitting specially crafted TOML input.

Critical Impact

Attackers can cause application crashes through stack overflow by providing malicious TOML content, potentially leading to service disruption and denial of service conditions.

Affected Products

• FasterXML jackson-dataformats-text (all versions prior to patched release)

Discovery Timeline

• August 8, 2023 - CVE-2023-3894 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-3894

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the TOML parsing component of jackson-dataformats-text. When processing user-supplied TOML data, the parser fails to adequately handle deeply nested or recursive structures, leading to uncontrolled stack consumption. The vulnerability is network-exploitable without authentication or user interaction, making it accessible to remote attackers who can submit malicious input to any application using the vulnerable library for TOML parsing.

Root Cause

The root cause is twofold: improper input validation (CWE-20) combined with an out-of-bounds write condition (CWE-787). The TOML parser does not implement sufficient depth limits or recursion guards when processing nested TOML structures. This allows an attacker to craft input that causes excessive recursive function calls, ultimately exhausting the call stack and triggering a stack overflow crash.

Attack Vector

The attack exploits the network-accessible TOML parsing functionality. An attacker submits specially crafted TOML data containing deeply nested structures or recursive elements. When the vulnerable parser processes this input, it enters an unbounded recursive parsing loop. The continuous function calls exhaust the available stack memory, resulting in a stack overflow that crashes the application.

The vulnerability was identified through fuzzing by the OSS-Fuzz project, which discovered that certain TOML input patterns could reliably trigger the crash condition. Since no user interaction is required and the attack can be executed remotely over the network, any internet-facing application parsing untrusted TOML data is at risk.

Detection Methods for CVE-2023-3894

Indicators of Compromise

• Application crashes with stack overflow exceptions when processing TOML input
• Java StackOverflowError exceptions in application logs originating from jackson-dataformats-text TOML parsing classes
• Unusual spikes in TOML parsing requests or malformed TOML submissions
• Service restarts coinciding with TOML data processing activities

Detection Strategies

• Monitor application logs for StackOverflowError or similar stack exhaustion exceptions during TOML parsing operations
• Implement input size and nesting depth validation before passing data to the TOML parser
• Use application performance monitoring to detect abnormal memory consumption patterns during parsing

Monitoring Recommendations

• Configure alerting for repeated application crashes or restarts in services that process TOML data
• Monitor for unusually large or deeply nested TOML payloads in incoming requests
• Track the frequency and source of TOML parsing exceptions to identify potential attack patterns

How to Mitigate CVE-2023-3894

Immediate Actions Required

• Update jackson-dataformats-text to the latest patched version immediately
• Implement input validation to reject TOML data exceeding reasonable size or nesting depth thresholds
• Consider sandboxing or resource-limiting TOML parsing operations to contain potential crashes
• Review application architecture to ensure TOML parsing failures do not cascade to critical services

Patch Information

FasterXML has addressed this vulnerability through Pull Request #398. Users should upgrade to the patched version as documented in the Jackson Release Notes. The fix implements proper recursion depth limits and input validation to prevent stack overflow conditions.

Workarounds

• Implement a maximum depth limit for TOML structures before passing to the parser
• Add a wrapper that catches StackOverflowError to prevent complete application failure
• Limit the maximum size of TOML input accepted from untrusted sources
• Consider using alternative TOML parsing libraries until upgrade is possible

# Maven dependency update example for jackson-dataformats-text
# Update your pom.xml to use the latest patched version:
# <dependency>
#   <groupId>com.fasterxml.jackson.dataformat</groupId>
#   <artifactId>jackson-dataformat-toml</artifactId>
#   <version>[LATEST_PATCHED_VERSION]</version>
# </dependency>

# Verify your current version with:
mvn dependency:tree | grep jackson-dataformat-toml