Top 10 winner

JSON Interoperability Vulnerabilities

@bishopfox · Bishop Fox

A survey of 49 JSON parsers shows they disagree on duplicate keys, invalid Unicode, comments and large numbers, so the same document decodes to different values in different microservices. An attacker can craft a document that a validating service reads as safe while a downstream service reads as hostile, smuggling values past business logic, sanitisation and authorisation checks.

Record

Researcher

@bishopfox

Published by

Bishop Fox

In the archive

• Ranked #7 in the 2021 Top 10 Web Hacking Techniques

Related sources

• Hands-on research labs
• Earlier JSON parsing deep dive

Tags

• parser-differential
• filter-bypass
• auth-bypass
• smuggling
• encoding
• unicode
• rest-api
• measurement-study
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of @bishopfox, first published at the original source. Preserved copies are kept so the citation survives its host.