CVE-2017-17485: Remote Code Execution in jackson-databind
Summary
CVE-2017-17485: FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.7.9.2
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.4
Fixed in 2.7.9.2, 2.8.11 or 2.9.4, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2017-17485 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects versions 2.8.10 and 2.9.x through 2.9.3 of the package. The vulnerability allows unauthenticated remote code execution due to incorrect deserialization and a bypass of the blocklist. The issue stems from an incomplete fix for the CVE-2017-7525 deserialization flaw. Attackers can exploit this vulnerability by sending maliciously crafted JSON input to the readValue method of the ObjectMapper. The vulnerability bypasses a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerability Detail
The vulnerability in jackson-databind allows remote attackers to execute arbitrary code on the affected system. By exploiting the incomplete fix for the CVE-2017-7525 deserialization flaw, an attacker can send specially crafted JSON input to the readValue method of the ObjectMapper. This can lead to the execution of arbitrary code, potentially compromising the confidentiality, integrity, and availability of the system. The vulnerability is considered critical with a CVSS score of 9.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.9.22.7.9.2 -
>= 2.8.0, < 2.8.112.8.11 -
>= 2.9.0, < 2.9.42.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the jackson-databind package is not immediately feasible, a possible workaround is to remove the Spring libraries from the classpath. By doing so, the bypass of the blocklist can be prevented. However, this workaround may have implications on the functionality of the application, especially if it relies on Spring libraries. It is recommended to consult with the development team and assess the impact before applying this workaround.
Conclusion
The CVE-2017-17485 vulnerability in jackson-databind exposes systems to remote code execution. It is crucial to upgrade the package to version 2.9.4 or later to mitigate the risk. If immediate upgrade is not possible, consider removing the Spring libraries from the classpath as a temporary workaround. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
jackson-databind is a Java library used for JSON data serialization and deserialization. It provides functionality to convert JSON data to Java objects and vice versa.
The vulnerability allows remote code execution, which can lead to the compromise of the affected system. Attackers can execute arbitrary code, potentially gaining unauthorized access, manipulating data, or causing denial of service.
To fix this vulnerability, upgrade the jackson-databind package to version 2.9.4 or later. Update the package in your project's dependencies and rebuild the application. Thoroughly test the updated application to ensure compatibility and proper functioning.
If immediate package upgrade is not possible, you can remove the Spring libraries from the classpath to prevent the bypass of the blocklist. However, this workaround may impact the functionality of the application, so it is recommended to assess the implications before applying it.
For more information about this vulnerability, you can refer to the official GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-rfx6-vp9g-rh7v/GHSA-rfx6-vp9g-rh7v.json
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
