CVE-2018-14721: Server-Side Request Forgery (SSRF) in jackson-databind
Summary
CVE-2018-14721: Server-Side Request Forgery (SSRF) in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind across 3 version ranges.
>= 2.7.0, < 2.7.9.5
>= 2.8.0, < 2.8.11.3
>= 2.9.0, < 2.9.7
Fixed in 2.7.9.5, 2.8.11.3 or 2.9.7, depending on the release line you run. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2018-14721 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library used for serializing and deserializing JSON data. It provides functionality for converting JSON data to Java objects and vice versa. This vulnerability affects versions 2.7.0 to 2.9.7 of the package. The vulnerability allows remote attackers to exploit server-side request forgery (SSRF) by leveraging a failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerability Detail
The vulnerability arises from a flaw in the jackson-databind library's handling of deserialization. By exploiting this flaw, an attacker can manipulate the deserialization process to make unauthorized requests to internal resources, potentially leading to information disclosure, remote code execution, or other malicious activities. The vulnerability has a CVSS score of 10.0, indicating its critical severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.9.52.7.9.5 -
>= 2.8.0, < 2.8.11.32.8.11.3 -
>= 2.9.0, < 2.9.72.9.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable polymorphic deserialization in the jackson-databind library. This can be achieved by configuring the library to use a custom TypeResolverBuilder that does not allow for polymorphic deserialization. Here is an example of how to disable polymorphic deserialization using a TypeResolverBuilder:
ObjectMapper mapper = new ObjectMapper();
TypeResolverBuilder<?> typeResolver = new DefaultTypeResolverBuilder(ObjectMapper.DefaultTyping.NON_FINAL);
typeResolver.init(JsonTypeInfo.Id.NONE, null);
mapper.setDefaultTyping(typeResolver);
Note that this workaround may impact the functionality of the application, as it disables a feature of the library.
Conclusion
The jackson-databind package is vulnerable to a critical SSRF vulnerability that allows attackers to manipulate the deserialization process and perform unauthorized requests. It is crucial to upgrade to version 2.9.7 or later to mitigate this vulnerability. If immediate upgrading is not possible, disabling polymorphic deserialization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
The vulnerability allows attackers to perform server-side request forgery (SSRF) attacks, potentially leading to unauthorized access to internal resources, information disclosure, remote code execution, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it to identify any vulnerable dependencies.
Yes, the vulnerability can be fixed by upgrading the jackson-databind package to version 2.9.7 or later. It is recommended to update your project's dependencies to use the latest version of the package.
If upgrading to the latest version is not immediately feasible, you can temporarily disable polymorphic deserialization in the jackson-databind library. This can be done by configuring a custom TypeResolverBuilder that does not allow for polymorphic deserialization.
The CVSS score of this vulnerability is 10.0, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
