CVE-2020-8840: Deserialization vulnerability in com.fasterxml.jackson.core:jackson-databind

What is CVE-2020-8840 About?

FasterXML jackson-databind 2.x versions before 2.6.7.4, 2.7.9.7, 2.8.11.5, and 2.9.10.2 are vulnerable due to inadequate blocking of xbean-reflect/JNDI gadgets. This allows for deserialization of untrusted data, potentially leading to remote code execution. Exploitation requires specific knowledge of gadget chains and JNDI.

Affected Software

com.fasterxml.jackson.core:jackson-databind
- >2.0.0, <2.6.7.4
- >2.8.0, <2.8.11.5
- >2.7.0, <2.7.9.7
- >2.9.0, <2.9.10.3

Technical Details

FasterXML jackson-databind 2.x versions before 2.6.7.4, 2.7.9.7, 2.8.11.5 and 2.9.10.2 suffer from a deserialization vulnerability stemming from insufficient blocking of certain `xbean-reflect` and JNDI gadgets, specifically `org.apache.xbean.propertyeditor.JndiConverter`. When `jackson-databind` is configured for polymorphic deserialization (e.g., via `DefaultTyping.JAVA_LANG_OBJECT`), and an attacker provides a maliciously crafted JSON payload that specifies the `JndiConverter` class, the deserializer attempts to instantiate this class. The `JndiConverter` can then be leveraged to perform arbitrary JNDI lookups, potentially leading to remote code execution by fetching and executing code from an attacker-controlled LDAP or RMI server.

What is the Impact of CVE-2020-8840?

Successful exploitation may allow attackers to achieve arbitrary code execution by leveraging deserialization vulnerabilities, leading to full system compromise.

What is the Exploitability of CVE-2020-8840?

Exploiting this deserialization vulnerability is complex, requiring an attacker to craft a specialized JSON payload to trigger the `JndiConverter` gadget. The attacker needs to understand the classpath of the application to identify available gadgets and potentially a JNDI injection endpoint. There are no explicit authentication or privilege requirements beyond the ability to submit arbitrary JSON data to a vulnerable deserialization endpoint. This is a remote vulnerability, sending malicious JSON over the network. Specific conditions include the application using `jackson-databind` for deserialization of untrusted input, especially with polymorphic typing, and the presence of `xbean-reflect` on the classpath. Factors increasing risk include processing untrusted external data and not implementing deserialization whitelisting or blacklisting effectively.

What are the Known Public Exploits?

PoC Author	Link	Commentary
jas502n	Link	FasterXML/jackson-databind 远程代码执行漏洞
fairyming	Link	CVE-2020-8840：FasterXML/jackson-databind 远程代码执行漏洞
Wfzsec	Link	来源于jackson-CVE-2020-8840，需要开autotype

What are the Available Fixes for CVE-2020-8840?

A Fix by Resolved Security Exists!

Learn more how to fix vulnerabilities in open source dependencies seamlessly

About the Fix from Resolved Security

This patch adds org.apache.xbean.propertyeditor.JndiConverter to the blacklist of classes that cannot be deserialized by Jackson. By blocking deserialization of this class, it prevents attackers from exploiting unsafe Java object deserialization leading to remote code execution, which is the core of vulnerability CVE-2020-8840.

Available Upgrade Options

com.fasterxml.jackson.core:jackson-databind
- >2.0.0, <2.6.7.4 → Upgrade to 2.6.7.4
com.fasterxml.jackson.core:jackson-databind
- >2.7.0, <2.7.9.7 → Upgrade to 2.7.9.7
com.fasterxml.jackson.core:jackson-databind
- >2.8.0, <2.8.11.5 → Upgrade to 2.8.11.5
com.fasterxml.jackson.core:jackson-databind
- >2.9.0, <2.9.10.3 → Upgrade to 2.9.10.3

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2020-8840?

Similar Vulnerabilities: CVE-2020-9548 , CVE-2019-12384 , CVE-2019-12814 , CVE-2019-14540 , CVE-2019-14439

CVE-2020-8840 Deserialization vulnerability in com.fasterxml.jackson.core:jackson-databind