Critical Polymorphic Typing Vulnerability in jackson-databind Affects JSON Endpoints
Summary
CVE-2019-12086: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Affects jackson-databind across 2 version ranges.
< 2.9.8-2
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < ec1adf8c72625fd51b30105afad7464c4332d542
Fixed in 2.9.8-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a widely used library in Java for converting Java objects to and from JSON. It is part of the FasterXML project and is integral for applications that require JSON processing. The library supports various features such as data binding, serialization, and deserialization. However, it has a critical vulnerability that arises when Default Typing is enabled, exposing applications to potential attacks.
Vulnerability Detail
A Polymorphic Typing issue was discovered in FasterXML jackson-databind versions prior to 2.9.9. When Default Typing is enabled for an externally exposed JSON endpoint, and the mysql-connector-java jar (8.0.14 or earlier) is present in the classpath, an attacker can exploit this vulnerability. By hosting a crafted MySQL server and sending a specially crafted JSON message, the attacker can read arbitrary local files on the server. This vulnerability is due to the lack of validation in the com.mysql.cj.jdbc.admin.MiniAdmin class, which can lead to severe data breaches.
How To Fix
Minimum fixed version
2.9.8-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling Default Typing in your application configuration. This can be done by setting the following property in your JSON processing configuration:
ObjectMapper objectMapper = new ObjectMapper();
objectMapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);
// Disable this line to mitigate the risk.
Conclusion
The polymorphic typing vulnerability in jackson-databind poses significant risks to applications that expose JSON endpoints. It is crucial to upgrade to the latest version or implement workarounds to mitigate the risks associated with this vulnerability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for jackson-databind →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
All versions of jackson-databind prior to 2.9.9 are affected by this vulnerability.
If immediate upgrading is not feasible, disable Default Typing in your application configuration as a temporary workaround.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server, resulting in data breaches and potential loss of confidentiality.
References
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
