Skip to main content

JSON Policy Settings

[Policy] > [Basic Demilitarization Policy] > [JSON] Settings​

The JSON tab sets policies to block security threats that may be included in JSON files.
You can defend against JSON-based attacks by controlling duplicate keys, executable links, embedded files, dangerous keys, operators, and so on.

⚠️ The permission to set the basic de-identification policy is granted to [Administrator Type - System Administrator], and
Administrator permission settings can be found under [Administrator Settings] > [Account and Permission Management].

Detailed Description of Settings Items​

Policy NameDescription
Setting to Block Duplicate Keys in JSONSet whether to block when duplicate keys are included in JSON.
If keys are duplicated, it is impossible to predict which value will be applied, and permissions or settings may change.
---
There is a case of exploiting this vulnerability to gain administrative privileges (CVE-2017-12635).
Setting Block for Specified Executable LinksSpecify the executable link schemes to block when included in JSON.
Executable schemes such as javascript, data, vbscript, and file can trigger code execution or file access when clicked.
input example) javascript;data;vbscript;file;
Blocking settings for specified built-in file formats (MIME)Specify the file types (MIME) to block when included in JSON.
A JSON file can contain files encoded in base64, which poses a risk of executing malicious code.
---
It is recommended to block executable files such as EXE or DLL by default. Setting it to an empty value will block all file types.
input example) application/x-dosexec;application/zip;
Setting Block for Specified Risk KeysSpecify the risky keys to be blocked when included in JSON.
__proto__, constructor, etc. are risky keys that can change internal operations, potentially altering permissions and settings. (Related case: CVE-2018-16487)
input example) __proto__;constructor;
Setting Specified Operator BlockageSpecify the operators to block when including in JSON.
The $ operator used in databases like MongoDB can execute arbitrary commands, which can lead to data tampering, theft, and privilege escalation.
Input example) $where;$eval;

Input Rules and Precautions​

  • Setting Block for Specified Executable LinksYou can enter multiple schemes separated by semicolons (;).
  • **Blocking settings for specified built-in file formats (MIME)**The MIME type is entered separated by semicolons (;), and setting it to an empty value will block all file types.
  • Setting Block for Specified Risk KeysYou can enter multiple keys separated by semicolons (;).
  • Setting Specified Operator BlockageYou can enter multiple operators separated by semicolons (;).

Reference Notes​

TerminologyDefinitionSecurity Threats
Duplicate KeyWhen the same key is used more than once in a JSON fileIt is unpredictable what value will be applied, so permissions or settings may change.
Executable Link Schemeprotocols that trigger code execution or file access when clicking on javascript, data, vbscript, file, etc.It can lead to the execution of malicious code or access to the file system.
Embedded File (Base64)Files included in a JSON file encoded in base64Malware can be included in the form of a file and executed.
Risk KeySpecial keys that can change the internal workings of JavaScript, such as __proto__ and constructor.Prototype pollution attacks can change permissions or settings.
$ operatorQuery operators used in NoSQL databases like MongoDBExecuting arbitrary commands can lead to data tampering, theft, and privilege escalation.
  • After changing the settings, you can check the records and restore them in the [Policy Change History] menu.