Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._renameProperties() and BeanDeserializerFactory.addBeanProps() methods, which rename rather than drop a property whose getter carries @JsonProperty and whose setter carries @JsonIgnore, leaving the private backing field writable. An attacker can write a field that was meant to be unsettable, enabling property tampering and mass assignment, by supplying the renamed JSON key during deserialization, because the factory observes hasField()==true and builds a writable FieldProperty for the backing field. Exploitation requires MapperFeature.INFER_PROPERTY_MUTATORS to be enabled, which is the default, and a target type that pairs a renamed getter with an ignored setter, and the impact is limited to writing existing fields with no path to remote code execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the BeanDeserializerBase.createContextual() method, which applies the per-property exclusions through _handleByNameInclusion() and then rebuilds the property map from the unfiltered original, overwriting the filtered map and restoring every property the exclusion had removed. An attacker can set fields that were marked ignored, enabling mass assignment, by supplying those property names in untrusted JSON during deserialization. Exploitation requires case-insensitive property matching to be enabled via @JsonFormat with ACCEPT_CASE_INSENSITIVE_PROPERTIES alongside per-property @JsonIgnoreProperties.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the POJOPropertiesCollector._removeUnwantedIgnorals process. An attacker can access or modify properties that were intended to be ignored by supplying JSON input with keys matching the renamed property names, thereby bypassing intended access restrictions.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the JDKFromStringDeserializer class, which constructs InetSocketAddress and resolves the hostname through DNS at deserialization time. An attacker can force the server to issue outbound DNS lookups for chosen hostnames by submitting JSON that is deserialized into a type holding an InetSocketAddress field, with no authentication required. The observable effect is limited to DNS resolution of attacker-chosen names, useful for out-of-band interaction or internal resolver probing rather than a full outbound request, and it applies only where the application deserializes untrusted JSON into types containing such fields.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the STD_INET_ADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind SSRF behavior by supplying a hostname string in JSON that is deserialized into java.net.InetAddress. When application code binds untrusted input into an InetAddress field or type, the deserializer calls InetAddress.getByName(value) on the attacker-controlled string and resolves it before any application validation runs. This lets an attacker force DNS-based callbacks or probe internal hostnames, causing unwanted network egress and leaking resolver-visible information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5, 2.22.1 or higher.

References

• GitHub Commit jackson-databind-2.21.1
• GitHub Commit jackson-databind-3.2.1
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue() to resolve an attacker-controlled java.nio.file.Path URI by supplying a non-file scheme such as jar:, http:, s3:, or a custom provider scheme in untrusted JSON. That input reaches new URI(value) and then Path.of(uri), which falls back to ServiceLoader<FileSystemProvider> resolution and can invoke a matching provider’s getPath(uri) during deserialization. The result is unintended provider loading and provider-driven path handling inside the application, which can trigger denial of service or other side effects depending on what FileSystemProvider implementations are present on the classpath.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-classic to version 1.5.33 or higher.

References

• Apache Jira Issues
• GitHub Commit
• Release Notes

Overview

ch.qos.logback:logback-core is a logback-core module.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in HardenedObjectInputStream, whose resolveClass allowlist admitted any class whose name starts with java.lang or java.util rather than matching specific authorized classes. An attacker can instantiate dangerous classes such as java.lang.ProcessBuilder during deserialization, reaching remote code execution through a gadget chain, by delivering a malicious serialized object to a logback component that deserializes it, such as its socket receiver for serialized logging events (SocketNode). Exploitation requires the application to deserialize attacker-controlled serialized data through logback, in practice via its socket-based receiver, together with a usable gadget class on the classpath.

Workaround

This vulnerability can be avoided by not exposing logback's socket-based serialized receivers, such as SocketReceiver and ServerSocketReceiver, to untrusted networks, which removes the path by which attacker-controlled serialized objects reach the deserialization filter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade ch.qos.logback:logback-core to version 1.5.33 or higher.

References

• Apache Jira Issues
• GitHub Commit
• Release Notes

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the isSafeSubType() method of DefaultBaseTypeLimitingValidator, whose denylist of unsafe base types omits java.lang.Comparable, so the method returns true for any subtype resolved under a Comparable base. An attacker can trigger instantiation of arbitrary classes that implement Comparable, such as java.io.File to reach path-traversal primitives, by sending JSON with attacker-controlled type identifiers. This requires the application to use a bare @JsonTypeInfo with the default validator and no explicit PolymorphicTypeValidator, and a property or class whose declared base type is Comparable.

Workaround

This vulnerability can be avoided by configuring an explicit restrictive PolymorphicTypeValidator, such as a BasicPolymorphicTypeValidator allowlist passed to activateDefaultTyping(), instead of relying on the default validator.

Note: The discoverer of this vulnerability reports that "I have not identified a class implementing Comparable that yields code execution purely through deserialization".

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the BeanDeserializer._deserializeUsingPropertyBased method, whose property-buffering branch omits the prop.visibleInView(activeView) check that the creator-property branch performs. An attacker can populate view-restricted setterless collection or map properties, such as admin-only fields, from untrusted JSON by supplying values for them during deserialization, bypassing @JsonView protection. This affects only setterless collection or map properties annotated with a restricted @JsonView and reached through the property-based creator path.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method, which replays buffered JSON into creator parameters without consulting prop.visibleInView(activeView). An attacker can set view-restricted constructor parameters annotated with both @JsonView and @JsonUnwrapped, such as admin-only fields, from untrusted JSON by supplying them during deserialization while a more restrictive view is active, defeating the @JsonView write-side authorization boundary.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Incorrect Authorization in the deserializeUsingPropertyBasedWithExternalTypeId file. An attacker can populate restricted creator properties from untrusted input by crafting JSON that exploits the lack of view checks on parameters annotated with both @JsonView and @JsonTypeInfo(include=As.EXTERNAL_PROPERTY). This allows unauthorized assignment of sensitive fields, even when a restrictive view is active, by injecting values through polymorphic type information.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit