# Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)

Kernel#JSON and other JSON entry points bypassed the CVE-2013-0269 fix, allowing attacker-controlled json_create calls to instantiate arbitrary named classes.

- Payout: hidden
- Severity: medium
- Program: Ruby
- Found by: jeremyevans
- Disclosed: 2020-04-23
- CVE: CVE-2013-0269
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/706934
- Library page: https://bugbountylibrary.com/r/h1%3A706934
- Tags: area:oss domain:oss impact:dos impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:incomplete-fix technique:source-review vuln:deserialization vuln:dos

**Target:** Ruby stdlib JSON parser (ext/json/parser/parser.c)
**Root cause:** cParser_initialize has two branches depending on whether an options hash is passed; the CVE-2013-0269 fix only patched the branch where an options hash is provided, leaving the nil-options branch with create_additions enabled.
**Steps:**
1. Call `JSON(js)` where js is attacker-controlled JSON containing `json_class` and `args` keys.
2. Kernel#JSON passes args.first (nil) to JSON.parse, hitting the unfixed cParser_initialize branch.
3. Parser honors create_additions and invokes `json_create` on the named constant with attacker args.
4. Also reachable via `JSON.parse(js, nil)`, `JSON[js, nil]`, and `JSON::Parser.new(js).parse`.
**How found:** While doing keyword argument separation work on rb_scan_args, noticed the `:` handling of nil option hash and traced that cParser_initialize's nil-options branch was never patched by CVE-2013-0269; realized security implications later.
**Exploitation:** Attacker supplies JSON with json_class naming a constant whose json_create is callable; parser instantiates it with attacker-controlled args. If json/add/* is loaded, arbitrary core objects (OpenStruct, Regexp) can be created, enabling DoS via crafted Regexp or worse.
**Escalation:** Requiring json/add/ostruct or json/add/regexp widens impact to arbitrary object creation and potential ReDoS/RCE via regexp engine bugs.
**Insight:** When a security fix patches a function with multiple code paths (e.g. option-hash vs nil), audit every branch — the unpatched sibling path is a classic incomplete-fix variant. Also check convenience wrappers like Kernel#JSON that route to the unpatched path.