Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

Upgrade org.apache.commons:commons-lang3 to version 3.18.0 or higher.

References

• Apache Pony Mail
• GitHub Commit

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Denial of Service (DoS) due to missing input size validation when performing numeric type conversions. A remote attacker can exploit this vulnerability by causing the application to deserialize data containing certain numeric types with large values, causing the application to exhaust all available resources.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.15.0-rc1 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Stack-based Buffer Overflow due to the parse process, which accepts an unlimited input file with deeply nested data. An attacker can cause a stack overflow and crash the application by providing input files with excessively deep nesting.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.15.0-rc1 or higher.

References

• GitHub Commit
• GitHub PR

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling via the parsing of chunk extensions in HTTP/1.1 messages with chunked encoding. An attacker can bypass HTTP request boundaries by sending specially crafted HTTP requests that exploit differences in how standalone newline characters are parsed between reverse proxies and the backend, potentially allowing them to smuggle additional requests.

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.125.Final, 4.2.5.Final or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub Issue
• GitHub PR

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the BrotliDecoder.decompress function, which has no limit on how often it calls pull, decompressing data 64K bytes at a time. An attacker can exhaust system memory and cause application downtime by submitting specially crafted compressed input that triggers excessive buffer allocations.

PoC

import io.netty.buffer.Unpooled;
import io.netty.channel.embedded.EmbeddedChannel;

import java.util.Base64;

public class T {
    public static void main(String[] args) {
        EmbeddedChannel channel = new EmbeddedChannel(new BrotliDecoder());
        channel.writeInbound(Unpooled.wrappedBuffer(Base64.getDecoder().decode("aPpxD1tETigSAGj6cQ8vRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROMBIAEgIaHwBETlQQVFcXlgA=")));
    }
}

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.125.Final or higher.

References

• GitHub Commit
• GitHub Commit

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. A flaw was found in FasterXML Jackson Databind, where it does not have entity expansion secured properly in the DOMDeserializer class. The highest threat from this vulnerability is data integrity.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.7, 2.10.5.1 or higher.

References

• GitHub Commit
• GitHub Issue
• RedHat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the SAML2AssertionValidator method. Access to external entities was not disabled in XML parsing.

Remediation

Upgrade com.nimbusds:oauth2-oidc-sdk to version 8.36.2, 9.3.1 or higher.

References

• BitBucket Commit
• BitBucket Issue

Overview

io.netty:netty-codec is an event-driven asynchronous network application framework.

Affected versions of this package are vulnerable to Uncontrolled Memory Allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Remediation

Upgrade io.netty:netty-codec to version 4.1.46.Final or higher.

References

• GitHub Issue

• GitHub PR

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Improper Access Control when the application uses AuthenticatedVoter directly and a null authentication parameter is passed to it. Exploiting this vulnerability resulting in an erroneous true return value.

Note

Users are not affected if:

1. The application does not use AuthenticatedVoter#vote directly.

2. The application does not pass null to AuthenticatedVoter#vote.

Remediation

Upgrade org.springframework.security:spring-security-core to version 5.7.12, 5.8.11, 6.0.10, 6.1.8, 6.2.3 or higher.

References

• GitHub Commit
• GitHub Issue
• Security Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via the RegexRequestMatcher class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with . in the regular expression.

Remediation

Upgrade org.springframework.security:spring-security-web to version 5.4.11, 5.5.7, 5.6.4 or higher.

References

• GitHub Commit
• GitHub Fix Commit v5.5.7
• GitHub Fix Commit v5.6.4
• GitHub Issue
• PoC
• VMware Tanzu Security Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.6 or higher.

References

• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to the class ignite-jta.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Issue
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Post
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Commit
• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• Al1ex's Poc
• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• Al1ex's Poc
• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.8 or higher.

References

• GitHub Issue
• Medium Article
• Poc

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A malicious user could perform a SSRF attack via the javax.swing gadget (specifically javax.swing.JTextPane).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.5, 2.9.10.7 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub Release
• RedHat Bugzilla Bug

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. When Default Typing is enabled for an externally exposed JSON endpoint, the service has the mysql-connector-java jar in the classpath. An attacker can host a crafted MySQL server reachable by the victim and send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs due to missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9, 2.8.11.4, 2.7.9.6, 2.6.7.3 or higher.

References

• GitHub Commit
• GitHub Issue
• Github Release Tag
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data which allows attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.1, 2.8.11.4, 2.7.9.6 or higher.

References

• Debian Security Announcement
• Exploit
• Github Fix
• GitHub Issue
• Jackson CVEs Don't Panic - Blog
• Release Notes

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. SubTypeValidator.java mishandles default typing when ehcache is used, leading to remote code execution.

NOTE: This vulnerability has also been identified as: CVE-2019-14439

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.2, 2.8.11.4, 2.7.9.6 or higher.

References

• GitHub Comparison
• GitHub Issue
• GitHub Issue
• GitHub Issue
• Snyk Blog

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered as com.zaxxer.hikari.HikariDataSource was not blocked. Note: This is a different vulnerability than CVE-2019-14540.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10, 2.8.11.5, 2.6.7.3 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered as com.zaxxer.hikari.HikariConfig was not blocked. Note: This is a different vulnerability than CVE-2019-16335.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10, 2.8.11.5, 2.6.7.3 or higher.

References

• Exploit
• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.cxf.jaxrs.provider.XSLTJaxbProvider.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10, 2.8.11.5, 2.6.7.3 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered within org.apache.commons.dbcp.datasources.SharedPoolDataSource was not blocked. An attacker could leverage this gadget type to perform Remote Code Execution attacks through deserialization.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.1, 2.8.11.5, 2.6.7.3 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered as com.p6spy.engine.spy.P6DataSource was not blocked. An attacker could leverage this gadget type to perform Remote Code Execution attacks through deserialization.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.1, 2.8.11.5, 2.6.7.3 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. A Polymorphic Typing issue was discovered related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10 or higher.

References

• GitHub Commit
• GitHub Comparison
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. When Default Typing is enabled for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.1 or higher.

References

• Blog Post
• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Two additional net.sf.ehcache gadgets are not blacklisted.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.10.2 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to an incomplete black list (incomplete fix for CVE-2017-7525). It lacks xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.5, 2.9.10.3 or higher.

References

• GitHub Commit
• GitHub Issue
• Jackson PoC
• PoC
• PoC
• PoC in GitHub

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Mishandles the interaction between serialization gadgets and typing, related to:

• com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)
• br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)
• org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config)

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.6, 2.9.10.4 or higher.

References

• GitHub Commit
• Github Issue #1
• GitHub Issue #2
• GitHub PoC
• PoC in GitHub
• Nuclei Templates
• Nuclei Templates

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to an incomplete black list (incomplete fix for CVE-2017-7525). It doesn't block common-configuration JNDI classes org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.3, 2.8.11.5, 2.9.10.3 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Issue
• RedHat Bugzilla

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Commit (Master)
• GitHub Issue
• On Jackson CVE's Blog
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Commit (Master)
• GitHub Issue
• On Jackson CVEs: Don’t Panic

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to gadget javax.swing.JEditorPane.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.7.9.7, 2.8.11.6, 2.9.10.4 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to gadget org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadget org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Commit
• GitHub Issue
• PoC

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadgets org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to gadget org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GItHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Issue
• Medium Post

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.4 or higher.

References

• GitHub Issues
• Medium Post

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using the com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (xalan2) class gadget if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

• GitHub Commit
• Github Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The package mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using the oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (apache/drill) class gadget if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

• GitHub Commit
• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It is possible to conduct a Deserialization attack using any of the following class gadget available within weblogic/oracle-aqjms if polymorphic type handling is enabled and an application using this package allows user input which gets deserialized.

• oracle.jms.AQjmsQueueConnectionFactory
• oracle.jms.AQjmsXATopicConnectionFactory
• oracle.jms.AQjmsTopicConnectionFactory
• oracle.jms.AQjmsXAQueueConnectionFactory
• oracle.jms.AQjmsXAConnectionFactory

Note: This vulnerability does not affect release 2.10.0 onward.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.5 or higher.

References

• GitHub Issue
• Medium Article

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. SubTypeValidator.java mishandles default typing when ehcache is used, leading to remote code execution.

NOTE: This vulnerability has also been identified as: CVE-2019-14379

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating objects from a sequence of bytes is called deserialization. Deserialization of untrusted data (CWE-502) occurs when an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the attacker to control the state or the flow of the execution.

com.fasterxml.jackson.core:jackson-databind allows deserialization of JSON input to Java objects. If an application using this dependency has the ability to deserialize a JSON string from an untrusted source, an attacker could leverage this vulnerability to conduct deserialization attacks.

Exploitation of unsafe deserialization attacks through jackson-databind requires the following prerequisites:

1. The target application allowing JSON user input which is processed by jackson-databind

An application using jackson-databind is only vulnerable if a user-provided JSON data is deserialized.

2. Polymorphic type handling for properties with nominal type are enabled

Polymorphic type handling refers to the addition of enough type information so that the deserializer can instantiate the appropriate subtype of a value. Use of "default typing" is considered dangerous due to the possibility of an untrusted method (gadget) managing to specify a class that is accessible through the class-loader and therefore, exposing a set of methods and/or fields.

3. An exploitable gadget class is available for the attacker to leverage

Gadget chains are specially crafted method sequences that can be created by an attacker in order to change the flow of code execution. These gadgets are often methods introduced by third-party components which an attacker could utilise in order to attack the target application. Not every gadget out there is supported by jackson-databind. The maintainers of jackson-databind proactively blacklists possible serialization gadgets in an attempt to ensure that it is not possible for an attacker to chain gadgets during serialization.

Further reading:

• On Jackson CVEs: Don’t Panic on Medium
• NCC Group Jackson Deserialization WhitePaper
• Java Security Best Practices

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.9.9.2, 2.8.11.4, 2.7.9.6 or higher.

References

• GitHub Comparison
• GitHub Issue
• GitHub Issue
• GitHub Issue
• Snyk Blog

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application, an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.6.7.4, 2.9.10.6 or higher.

References

• GitHub Issue
• Medium Article
• PoC

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Infinite loop due to the improper handling of certain inputs during the parsing of dump files. An attacker can cause the application to enter an infinite loop by supplying crafted inputs.

Remediation

Upgrade org.apache.commons:commons-compress to version 1.26.0 or higher.

References

• Apache Lists
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.

This vulnerability exposes applications that meet all of the following requirements:

1. Act in the role of a Login Client (e.g. http.oauth2Login())

2. Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application

3. Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])

This vulnerability does not expose applications that:

1. Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer())

2. Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")) in the client application

Remediation

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Release
• VMWare Advisory

Overview

Affected versions of this package are vulnerable to Remote Code Execution (RCE) when using java.sql.Statement or java.sql.PreparedStatement to process untrusted input. By default, it is allowed to call any static method of any Java class in the classpath resulting in code execution.

Workaround

Users who are unable to upgrade to the fixed version can set the system property hsqldb.method_class_names to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used.

Remediation

Upgrade org.hsqldb:hsqldb to version 2.7.1 or higher.

References

• Chromium Bugs
• GitHub Commit
• Mitigation
• SVN Commit

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Denial of Service (DoS) via a large depth of nested objects.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.12.6.1, 2.13.2.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

io.netty:netty-codec is an event-driven asynchronous network application framework.

Affected versions of this package are vulnerable to Denial of Service (DoS). SnappyFrameDecoder doesn't restrict chunk length any mad buffer skippable chunks in an unnecessary way, leading to excessive memory usage. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file), or by sending a huge skippable chunk.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade io.netty:netty-codec to version 4.1.68.Final or higher.

References

• GitHub Commit

Overview

io.netty:netty-codec is an event-driven asynchronous network application framework.

Affected versions of this package are vulnerable to Denial of Service (DoS). Bzip2Decoder doesn't allow setting size restrictions for decompressed data. An attacker can exploit this by providing a compressed file that, when decompressed, triggers an out-of-memory exception.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade io.netty:netty-codec to version 4.1.68.Final or higher.

References

• GitHub Commit

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the package mishandling Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header when using HTTP/1.1. This issue exists because of an incomplete fix for CVE-2019-16869.

NOTE: This vulnerability has also been identified as: CVE-2019-20445

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.44.Final or higher.

References

• GitHub PR
• HTTP Request Smuggling Demystified - Snyk Blog
• Netty 4.1.44 Release Notes
• POC: GitHub Issue
• POC: Potential Exploit

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling. It allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax or as an "invalid fold."

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.44.Final or higher.

References

• GitHub Commit
• HTTP Request Smuggling Demystified - Snyk Blog
• POC: GitHub Issue

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to HTTP Request Smuggling due to the package mishandling Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header when using HTTP/1.1. This issue exists because of an incomplete fix for CVE-2019-16869.

NOTE: This vulnerability has also been identified as: CVE-2020-7238

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.44.Final or higher.

References

• GitHub PR
• HTTP Request Smuggling Demystified - Snyk Blog
• Netty 4.1.44 Release Notes
• POC: GitHub Issue
• POC: Potential Exploit

Overview

net.minidev:json-smart is a Java JSON parser.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a StackOverflowError when parsing a deeply nested JSON array or object.

NOTE: Although this vulnerability was fixed in version 2.4.9 the maintainer recommends upgrading to 2.4.10, due to a remaining bug.

PoC

StringBuilder s = new StringBuilder();
for (int i = 0; i < 10000 ; i++) {
  s.append("{\"a\":");
}
s.append("1");
for (int i = 0; i < 10000 ; i++) {
  s.append("}");
}
JSONParser p = new JSONParser(JSONParser.MODE_JSON_SIMPLE);
p.parse(s.toString());

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade net.minidev:json-smart to version 2.4.9 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue

Overview

org.apache.commons:commons-compress is an API for working with compression and archive formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.apache.commons:commons-compress to version 1.21 or higher.

References

• Apache Security Advisory
• Apache Security Advisory
• Git Commit
• Git Commit

Overview

org.yaml:snakeyaml is a YAML 1.1 parser and emitter for Java.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to missing nested depth limitation for collections.

NOTE: This vulnerability has also been identified as: CVE-2022-38749

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.yaml:snakeyaml to version 1.31 or higher.

References

• Bitbucket Commit
• BitBucket Issues
• GitHub Commit

Overview

org.yaml:snakeyaml is a YAML 1.1 parser and emitter for Java.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to missing nested depth limitation for collections.

NOTE: This vulnerability has also been identified as: CVE-2022-25857

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.yaml:snakeyaml to version 1.31 or higher.

References

• Bitbucket Commit
• BitBucket Issues
• GitHub Commit