CVE-2019-14893: Polymorphic deserialization of malicious object in jackson-databind
Summary
CVE-2019-14893: Polymorphic deserialization of malicious object in jackson-databind. Affects com.fasterxml.jackson.core:jackson-databind versions >= 2.9.0, < 2.9.10. Fixed in 2.9.10. How to fix ↓
Also tracked for
- jackson-databind · Debian:11
The same CVE-2019-14893 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jackson-databind package is a popular Java library for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa. This vulnerability affects all versions of jackson-databind before 2.9.10 and 2.10.0. The vulnerability allows for polymorphic deserialization of malicious objects using the xalan JNDI gadget. This can occur when the package is used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS, or in any other way that ObjectMapper.readValue might instantiate objects from unsafe sources. Exploiting this vulnerability could lead to arbitrary code execution.
Vulnerability Detail
The vulnerability arises from the improper handling of polymorphic deserialization in jackson-databind. By manipulating the deserialization process, an attacker can inject a malicious object that can be executed when the deserialization occurs. This can result in arbitrary code execution, potentially leading to remote code execution or other malicious activities. The vulnerability has a high severity rating and is classified under CWE-502.
How To Fix
Minimum fixed version
2.9.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround is to disable polymorphic type handling methods such as enableDefaultTyping() and avoid using Id.CLASS or Id.MINIMAL_CLASS with @JsonTypeInfo. By avoiding these features, the vulnerability can be mitigated. However, it is strongly recommended to upgrade to the fixed versions as soon as possible.
Conclusion
The CVE-2019-14893 vulnerability in jackson-databind exposes applications to the risk of arbitrary code execution. It is crucial to upgrade to the fixed versions or apply the recommended workarounds to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.fasterxml.jackson.core:jackson-databind →
FAQ
Jackson-databind is a Java library for serializing and deserializing JSON data. It provides functionality to convert JSON data to Java objects and vice versa.
Polymorphic deserialization is the process of converting JSON data into objects of different types based on the information present in the JSON. It allows for flexible handling of different types of data.
The vulnerability occurs due to improper handling of polymorphic deserialization in jackson-databind. It allows for the injection of malicious objects during the deserialization process, leading to potential code execution.
Exploiting this vulnerability can lead to arbitrary code execution. This can result in remote code execution, unauthorized access to sensitive data, or other malicious activities.
To fix this vulnerability, upgrade to jackson-databind version 2.9.10 or 2.10.0. Alternatively, disable polymorphic type handling methods and avoid using certain features that can trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.fasterxml.jackson.core:jackson-databind.
