security.snyk.io Open in urlscan Pro
2a02:26f0:3500:880::ecd  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Developer Tools
 * Snyk Learn
 * Snyk Advisor
 * Code Checker

About Snyk
 1. Snyk Vulnerability Database
 2. Maven
 3. com.fasterxml.jackson.core:jackson-databind




DESERIALIZATION OF UNTRUSTED DATA AFFECTING
COM.FASTERXML.JACKSON.CORE:JACKSON-DATABIND PACKAGE, VERSIONS [,2.9.10.8)

--------------------------------------------------------------------------------

SEVERITY

Recommended
8.1
high
0
10

CVSS ASSESSMENT MADE BY SNYK'S SECURITY TEAM

Learn more


THREAT INTELLIGENCE


Exploit Maturity
Proof of concept
EPSS
0.36% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Deserialization of Untrusted Data vulnerabilities in an interactive
lesson.

Start learning
 * Snyk ID SNYK-JAVA-COMFASTERXMLJACKSONCORE-1056420
 * published 7 Jan 2021
 * disclosed 7 Jan 2021
 * credit Unknown

Report a new vulnerability Found a mistake?

INTRODUCED: 7 JAN 2021

CVE-2020-36179 Open this link in a new tab

CWE-502 Open this link in a new tab

Share



HOW TO FIX?

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or
higher.


OVERVIEW

com.fasterxml.jackson.core:jackson-databind is a library which contains the
general-purpose data-binding functionality and tree-model for Jackson Data
Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted
Data. The package mishandles the interaction between serialization gadgets and
typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.


DETAILS

Serialization is a process of converting an object into a sequence of bytes
which can be persisted to a disk or database or can be sent through streams. The
reverse process of creating objects from a sequence of bytes is called
deserialization. Deserialization of untrusted data (CWE-502) occurs when an
application deserializes untrusted data without sufficiently verifying that the
resulting data will be valid, allowing the attacker to control the state or the
flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input
to Java objects. If an application using this dependency has the ability to
deserialize a JSON string from an untrusted source, an attacker could leverage
this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires
the following prerequisites:


1. THE TARGET APPLICATION ALLOWING JSON USER INPUT WHICH IS PROCESSED BY
JACKSON-DATABIND

An application using jackson-databind is only vulnerable if a user-provided JSON
data is deserialized.


2. POLYMORPHIC TYPE HANDLING FOR PROPERTIES WITH NOMINAL TYPE ARE ENABLED

Polymorphic type handling refers to the addition of enough type information so
that the deserializer can instantiate the appropriate subtype of a value. Use of
"default typing" is considered dangerous due to the possibility of an untrusted
method (gadget) managing to specify a class that is accessible through the
class-loader and therefore, exposing a set of methods and/or fields.


3. AN EXPLOITABLE GADGET CLASS IS AVAILABLE FOR THE ATTACKER TO LEVERAGE

Gadget chains are specially crafted method sequences that can be created by an
attacker in order to change the flow of code execution. These gadgets are often
methods introduced by third-party components which an attacker could utilise in
order to attack the target application. Not every gadget out there is supported
by jackson-databind. The maintainers of jackson-databind proactively blacklists
possible serialization gadgets in an attempt to ensure that it is not possible
for an attacker to chain gadgets during serialization.


FURTHER READING:

 * On Jackson CVEs: Don’t Panic on Medium
 * NCC Group Jackson Deserialization WhitePaper
 * Java Security Best Practices


REFERENCES

 * Al1ex's Poc
 * GitHub Issue
 * Medium Article


CVSS SCORES

version 3.1
Expand this section


SNYK

8.1 high
 * Attack Vector (AV)
   Network
 * Attack Complexity (AC)
   High
 * Privileges Required (PR)
   None
 * User Interaction (UI)
   None

 * Scope (S)
   Unchanged

 * Confidentiality (C)
   High
 * Integrity (I)
   High
 * Availability (A)
   High

Expand this section


NVD

8.1 high
Expand this section


RED HAT

8.1 high


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * 
 * 
 * 
 * 


TRACK OUR DEVELOPMENT

 * 
 * 



© 2024 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.