CVE-2019-16335: Polymorphic Typing issue vulnerability in com.fasterxml.jackson.core:jackson-databind

What is CVE-2019-16335 About?

This is a Polymorphic Typing issue in FasterXML jackson-databind affecting versions before 2.9.10, 2.8.11.5, and 2.6.7.3. It is related to `com.zaxxer.hikari.HikariDataSource` and constitutes a deserialization vulnerability that could lead to various impacts including remote code execution. Exploitation depends on the presence of the vulnerable class in the classpath and enabled polymorphic typing.

Affected Software

com.fasterxml.jackson.core:jackson-databind
- >2.9.0, <2.9.10
- <2.6.7.3
- >2.7.0, <2.8.11.5

Technical Details

A Polymorphic Typing vulnerability exists in FasterXML jackson-databind versions prior to 2.9.10, 2.8.11.5, and 2.6.7.3. This vulnerability is specifically linked to the `com.zaxxer.hikari.HikariDataSource` class. When Default Typing is enabled in jackson-databind (either globally or for a specific property), an attacker can craft a malicious JSON payload. This payload would include type information designed to instantiate `HikariDataSource` and subsequently leverage a gadget chain initiated through its deserialization. If the `HikariDataSource` is used in a vulnerable configuration or within a context that allows for arbitrary code execution during object construction or method invocation upon deserialization, it can lead to severe consequences. The issue stems from the deserializer's ability to arbitrary instantiate classes, allowing an attacker to utilize available classes on the classpath as 'gadgets'.

What is the Impact of CVE-2019-16335?

Successful exploitation may allow attackers to execute arbitrary code on the server, conduct denial-of-service attacks, or achieve unauthorized information disclosure, depending on the available gadget chains.

What is the Exploitability of CVE-2019-16335?

Exploitation hinges on Default Typing being enabled in Jackson-databind and the `com.zaxxer.hikari.HikariDataSource` class being present in the application's classpath. The complexity is moderate, requiring the attacker to understand Java deserialization gadget chains. No authentication or specific privileges are required on the application itself, as the attack typically involves sending a crafted JSON payload to an exposed endpoint that deserializes it. This is a remote attack. The primary constraint is the presence of the specific vulnerable class and the configuration of Jackson-databind. The likelihood of exploitation increases in applications that deserialize untrusted data with polymorphic typing enabled.

What are the Known Public Exploits?

PoC Author	Link	Commentary
No known exploits

What are the Available Fixes for CVE-2019-16335?

A Fix by Resolved Security Exists!

Learn more how to fix vulnerabilities in open source dependencies seamlessly

About the Fix from Resolved Security

This patch blocks deserialization of the com.zaxxer.hikari.HikariDataSource class by adding it to the denylist in SubTypeValidator, preventing attackers from leveraging this class for remote code execution. It fixes CVE-2019-16335 by closing a deserialization gadget chain exposed through HikariDataSource, which could otherwise be abused to execute arbitrary code when processing untrusted JSON input.

Available Upgrade Options

com.fasterxml.jackson.core:jackson-databind
- <2.6.7.3 → Upgrade to 2.6.7.3
com.fasterxml.jackson.core:jackson-databind
- >2.7.0, <2.8.11.5 → Upgrade to 2.8.11.5
com.fasterxml.jackson.core:jackson-databind
- >2.9.0, <2.9.10 → Upgrade to 2.9.10

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2019-16335?

Similar Vulnerabilities: CVE-2019-14439 , CVE-2019-12814 , CVE-2019-16943 , CVE-2019-14540 , CVE-2017-7525

CVE-2019-16335 Polymorphic Typing issue vulnerability in com.fasterxml.jackson.core:jackson-databind