Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-3040— Out of Bounds Access Leading to Undefined Behavior

Quick assessment

Affected
Cloudflare lua-resty-json
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cloudflare lua-resty-json是Cloudflare公司的用于 lua 和 C 的 json 库。 lua-resty-json 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a之前版本存在安全漏洞，该漏洞源于如果使用lua-resty-json 包中的debug函数解析不受信任的输入，攻击者可能会启动 DoS 数据。

CVSS 3.7 · Low EPSS 0.71% · P52

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-3040

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out of Bounds Access Leading to Undefined Behavior
Source: CVE Program / CVE List V5
Vulnerability Description
A debug function in the lua-resty-json package, up to commit id 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a (merged in PR #14) contained an out of bounds access bug that could have allowed an attacker to launch a DoS if the function was used to parse untrusted input data. It is important to note that because this debug function was only used in tests and demos, it was not exploitable in a normal environment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
lua-resty-json 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cloudflare lua-resty-json是Cloudflare公司的用于 lua 和 C 的 json 库。 lua-resty-json 3ef9492bd3a44d9e51301d6adc3cd1789c8f534a之前版本存在安全漏洞，该漏洞源于如果使用lua-resty-json 包中的debug函数解析不受信任的输入，攻击者可能会启动 DoS 数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Cloudflare lua-resty-json 1 ~ 14 -

II. Public POCs for CVE-2023-3040

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-3040

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-3040 (1)

Vendor Advisories for CVE-2023-3040 (1)

IV. Related Vulnerabilities

Same vendor: Cloudflare
Same weakness: CWE-125

V. Comments for CVE-2023-3040

No comments yet

Leave a comment