Critical Polymorphic Typing Vulnerability in jackson-databind: Remote Code Execution Risk
Summary
CVE-2019-16942: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Affects jackson-databind across 2 version ranges.
< 2.10.0-2
>= e8df0987e3034d102ee6d704d30a05a2e3ac7089, < ec1adf8c72625fd51b30105afad7464c4332d542
Fixed in 2.10.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jackson-databind is a widely used library in Java for converting Java objects to JSON and vice versa. It is a core component of the FasterXML Jackson project, which provides data-binding capabilities for JSON. The library is known for its flexibility and performance, making it a popular choice for developers. However, it has been found to be vulnerable to a polymorphic typing issue that can lead to remote code execution when certain conditions are met.
Vulnerability Detail
A Polymorphic Typing issue was discovered in FasterXML jackson-databind versions 2.0.0 through 2.9.10. When Default Typing is enabled for an externally exposed JSON endpoint and the commons-dbcp (1.4) jar is present in the classpath, an attacker can exploit this vulnerability to execute a malicious payload. This vulnerability arises from the mishandling of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource, allowing unauthorized access to RMI service endpoints.
How To Fix
Minimum fixed version
2.10.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider disabling Default Typing in your application. This can be done by configuring your ObjectMapper instance as follows:
ObjectMapper objectMapper = new ObjectMapper();
objectMapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);
Ensure that you do not expose any JSON endpoints that utilize Default Typing until the vulnerability is resolved.
Conclusion
The polymorphic typing vulnerability in jackson-databind poses a significant risk of remote code execution. It is crucial for developers using this library to upgrade to a secure version and review their configurations to mitigate potential threats. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for jackson-databind →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
Versions 2.0.0 through 2.9.10 of jackson-databind are affected by this vulnerability.
An attacker can execute arbitrary code on the server by sending specially crafted JSON payloads to an exposed endpoint.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It helps you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
