CVE-2017-7525: Jackson-databind Deserialization Code Execution
Summary
CVE-2017-7525: jackson-databind is vulnerable to a deserialization flaw. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
< 2.6.7.1
>= 2.7.0, < 2.7.9.1
>= 2.8.0, < 2.8.9
Fixed in 2.6.7.1, 2.7.9.1 or 2.8.9, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2017-7525 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind library is a popular Java library used for converting JSON data to Java objects and vice versa. It provides a powerful and flexible API for handling JSON data. However, versions before 2.6.7.1, 2.7.9.1, and 2.8.9 are vulnerable to a deserialization flaw. This vulnerability allows an unauthenticated user to execute arbitrary code by sending maliciously crafted input to the readValue method of the ObjectMapper.
Vulnerability Detail
The deserialization flaw in jackson-databind arises from a lack of proper input validation during the deserialization process. An attacker can exploit this vulnerability by sending a specially crafted JSON payload that triggers the execution of arbitrary code on the server. This can lead to remote code execution, enabling the attacker to take control of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.7.12.6.7.1 -
>= 2.7.0, < 2.7.9.12.7.9.1 -
>= 2.8.0, < 2.8.92.8.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not immediately feasible, a temporary workaround is to disable or restrict the deserialization functionality in the application. This can be achieved by configuring the ObjectMapper to ignore or reject incoming JSON payloads during deserialization. Here's an example of how to disable deserialization in jackson-databind:
ObjectMapper mapper = new ObjectMapper();
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
By disabling deserialization, the vulnerability is effectively mitigated, but it is still recommended to upgrade to a fixed version as soon as possible.
Conclusion
The jackson-databind deserialization vulnerability (CVE-2017-7525) poses a significant risk to applications using vulnerable versions of the library. It is crucial to upgrade to a fixed version or apply the recommended workaround to mitigate the risk of remote code execution. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the system.
No, this vulnerability can be exploited by an unauthenticated attacker.
There have been reported instances of this vulnerability being actively exploited in the wild.
The recommended mitigation is to upgrade to a fixed version of the jackson-databind library. Disabling deserialization functionality can also serve as a temporary workaround.
Yes, this vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
