CVE-2018-14720: XML External Entity Reference (XXE) in jackson-databind
Summary
CVE-2018-14720: XML External Entity Reference (XXE) in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.7
Fixed in 2.7.9.5, 2.8.11.3 or 2.9.7, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-14720 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality for converting JSON data to Java objects and vice versa. This vulnerability affects versions 2.7.0 to 2.9.7 of the package. The vulnerability allows attackers to exploit XML External Entity (XXE) attacks by leveraging the failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerability Detail
The vulnerability arises from the improper handling of XML entities during deserialization. By crafting a malicious XML payload, an attacker can trigger the parsing of external entities, leading to various attacks such as server-side request forgery (SSRF), remote code execution (RCE), and disclosure of internal files. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.72.9.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable the processing of external entities in the XML parser used by the application. This can be achieved by configuring the XML parser to disallow the resolution of external entities. Below is an example of how to disable external entity resolution in the Apache Xerces XML parser:
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
SAXParser parser = factory.newSAXParser();
Note that this workaround may have implications on the functionality of the application, especially if legitimate use of external entities is required.
Conclusion
The jackson-databind package is vulnerable to XML External Entity (XXE) attacks, which can have severe consequences such as SSRF, RCE, and file disclosure. It is crucial to upgrade to version 2.9.7 or later to mitigate this vulnerability. If immediate upgrade is not possible, disabling external entity processing in the XML parser can serve as a temporary workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
This vulnerability allows attackers to conduct XML External Entity (XXE) attacks, which can lead to server-side request forgery (SSRF), remote code execution (RCE), and disclosure of internal files. It is a critical vulnerability with a CVSS score of 9.8.
Versions 2.7.0 to 2.9.7 of the jackson-databind package are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade the jackson-databind package to version 2.9.7 or later.
A temporary workaround is to disable the processing of external entities in the XML parser used by the application.
Yes, this vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
