Remote Code Execution Vulnerability in jackson-databind: CVE-2018-7489
Summary
CVE-2018-7489: FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. Affects jackson-databind across 2 version ranges.
< 2.9.5-1
< 5cacb069a16653844e4c04c2a53578666080c1bb
Fixed in 2.9.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a popular library in the Java ecosystem used for converting Java objects to JSON and vice versa. It is widely utilized in various applications for its efficiency and ease of use. However, the library has been found to be vulnerable to a remote code execution flaw due to improper handling of deserialization, particularly when certain libraries are present in the classpath.
Vulnerability Detail
CVE-2018-7489 is a critical vulnerability affecting versions of jackson-databind prior to 2.9.5. It stems from an incomplete fix for a previous deserialization flaw (CVE-2017-7525). Attackers can exploit this vulnerability by sending specially crafted JSON input to the readValue method of the ObjectMapper, leading to unauthorized remote code execution. This vulnerability is particularly dangerous as it allows unauthenticated users to execute arbitrary code on the server, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
2.9.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider removing the c3p0 library from the classpath, as its presence can bypass the existing blacklist protections. However, this is only a temporary measure and does not fully mitigate the risk associated with the vulnerability.
Conclusion
CVE-2018-7489 is a severe vulnerability in the jackson-databind library that poses significant security risks. It is crucial for developers using this library to upgrade to version 2.9.5 or later to protect their applications from potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2018-7489 is a vulnerability in the jackson-databind library that allows unauthenticated remote code execution due to improper deserialization handling.
Versions of jackson-databind prior to 2.9.5 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized remote code execution, allowing attackers to compromise the server and access sensitive data.
Yes, temporarily removing the c3p0 library from the classpath can help mitigate the risk, but it is not a permanent solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
