CVE-2024-53848: check-jsonschema Cache Confusion Vulnerability

CVE-2024-53848 Overview

CVE-2024-53848 affects check-jsonschema, a command-line interface (CLI) and set of pre-commit hooks for JSON schema validation. The default cache strategy stores remote schemas using the basename of the URL as the filename. This naming convention allows attackers to create cache collisions between legitimate and malicious schemas. An attacker who convinces a user to run check-jsonschema against a malicious schema URL can poison the cache with an attacker-controlled schema. Subsequent validations pick up the malicious cached schema instead of the intended one. The issue is patched in version 0.30.0 and tracked as [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

Critical Impact
A successful cache confusion attack causes data to pass schema validation that should have been rejected, undermining the integrity of validation pipelines.

Affected Products

check-jsonschema versions prior to 0.30.0
Python projects using check-jsonschema as a pre-commit hook
CI/CD pipelines invoking check-jsonschema against remote $ref schemas

Discovery Timeline

2024-11-29 - CVE-2024-53848 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53848

Vulnerability Analysis

The vulnerability stems from how check-jsonschema names cached schema files. When the tool downloads a remote schema over HTTP or HTTPS, it derives the local cache filename from the URL basename. A request to https://example.org/schema.json and a request to https://example.evil.org/schema.json both resolve to the same cache entry named schema.json. The cache does not distinguish schemas by origin, hash, or full URL.

An attacker who can influence a single invocation against a malicious URL can plant a schema file in the local cache. On subsequent runs, check-jsonschema reads the poisoned entry and applies the attacker's schema during validation. Because the malicious schema can be intentionally permissive, invalid data passes validation checks. The impact is a loss of validation integrity across pipelines that rely on the tool as a security control.

Root Cause

The cache layer implements weak filename derivation. It uses os.path.basename of the URL rather than a collision-resistant identifier derived from the full URL. This design maps distinct schema resources to the same cache slot, enabling one schema to overwrite another.

Attack Vector

Exploitation requires local execution of check-jsonschema with an attacker-influenced schema URL. This typically involves social engineering a developer, submitting a malicious pull request that references an attacker-hosted schema, or supply-chain contamination of shared configuration. No network privileges or authentication are needed on the target system beyond the ability to run the CLI.

python

# Security patch in src/check_jsonschema/cachedownloader.py
# Introduces hashlib for collision-resistant cache identifiers
from __future__ import annotations

import contextlib
import hashlib
import io
import os
import platform

Source: GitHub commit c52714b

The patch also extends caching semantics to schemas resolved through $ref lookups, ensuring consistent handling across all schema retrievals:

text

By default, when ``--schemafile`` is used to refer to an ``http://`` or
``https://`` location, the schema is downloaded and cached based on the
schema's Last-Modified time.

Additionally, when ``$ref``\s are looked up during schema resolution, they are
similarly cached.

Source: GitHub commit c52714b

Detection Methods for CVE-2024-53848

Indicators of Compromise

Presence of unexpected files in the check-jsonschema cache directory whose basenames match schemas fetched from untrusted domains.
CI logs showing check-jsonschema invocations against schema URLs outside the organization's approved schema registry.
Validation passes on data that historically failed under the same schema reference.

Detection Strategies

Audit repository history and CI configurations for --schemafile arguments pointing to external domains.
Compare cached schema file hashes against known-good hashes from the canonical schema source.
Enable verbose logging in check-jsonschema to capture the resolved URL and cache path for each run.

Monitoring Recommendations

Track outbound network calls from build agents to any host serving JSON schemas and alert on unapproved destinations.
Monitor changes to developer workstation cache directories used by check-jsonschema.
Flag pull requests that modify pre-commit configuration to reference new remote schema URLs.

How to Mitigate CVE-2024-53848

Immediate Actions Required

Upgrade check-jsonschema to version 0.30.0 or later across all developer workstations and CI/CD runners.
Purge existing check-jsonschema cache directories to remove any previously poisoned entries.
Review recent runs for invocations against untrusted schema URLs and revalidate impacted data.

Patch Information

The fix ships in check-jsonschema version 0.30.0. The patch introduces hashlib to derive collision-resistant cache identifiers and extends caching to $ref resolution. See the GitHub Security Advisory GHSA-q6mv-284r-mp36 and the remediation commit.

Workarounds

Run check-jsonschema with --no-cache to disable caching entirely.
Download the schema to a local file first and pass it via --schemafile ./schema.json.
Use --cache-filename to control cache filenames, noting that this flag is being deprecated as part of the remediation.

bash

# Recommended workaround: download the schema locally before validation
curl -LOs https://example.org/schema.json
check-jsonschema --schemafile ./schema.json data.json

# Alternative: disable caching entirely
check-jsonschema --no-cache --schemafile https://example.org/schema.json data.json