CVE-2017-15095

Q: What is the severity of CVE-2017-15095?

CVE-2017-15095 has a CVSS score of 9.8 (CRITICAL). CVE-2017-15095 is a critical deserialization vulnerability in jackson-databind that allows unauthenticated remote code execution by sending malicious input to ObjectMapper's readValue method. This affects applications using vulnerable versions of jackson-databind (before 2.8.10 or 2.9.1) that deserialize untrusted data. The vulnerability extends previous blacklisting protections from CVE-2017-7525 but still leaves systems exposed to new attack vectors.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

CVE-2017-15095 is a critical deserialization vulnerability in jackson-databind that allows unauthenticated remote code execution by sending malicious input to ObjectMapper's readValue method. This affects applications using vulnerable versions of jackson-databind (before 2.8.10 or 2.9.1) that deserialize untrusted data. The vulnerability extends previous blacklisting protections from CVE-2017-7525 but still leaves systems exposed to new attack vectors.

💻 Affected Systems

Products:

jackson-databind
Applications using jackson-databind for JSON processing
Oracle products listed in advisories

Versions: Versions before 2.8.10 and 2.9.1

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Applications must be using ObjectMapper with default polymorphic typing enabled or configured to deserialize untrusted data. The vulnerability specifically affects the readValue method when processing malicious JSON payloads.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary code with application privileges, potentially leading to data theft, ransomware deployment, or lateral movement within the network.

🟠

Likely Case

Remote code execution leading to application compromise, data exfiltration, and potential pivot to other systems in the environment.

🟢

If Mitigated

Limited impact if proper input validation and deserialization controls are implemented, potentially reduced to denial of service or information disclosure.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted JSON payloads to endpoints that use ObjectMapper.readValue() on untrusted input. The vulnerability extends previous blacklisting bypass techniques.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.8.10 or 2.9.1

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/1723

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.8.10 or later (2.9.1 for 2.9.x branch). 2. Update all transitive dependencies that include vulnerable versions. 3. Restart affected applications. 4. Verify no older versions remain in classpath.

🔧 Temporary Workarounds

Enable default typing blacklist

all

Configure ObjectMapper to use a more restrictive default typing or disable polymorphic deserialization for untrusted sources

ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping(); // Use with caution
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);

Input validation and filtering

all

Implement strict input validation and filtering for JSON payloads before deserialization

// Validate JSON structure before deserialization
// Use whitelisting for allowed classes
// Implement custom deserializers for sensitive types

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable applications from untrusted networks
Deploy web application firewall (WAF) rules to block malicious JSON payloads containing suspicious class names

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for jackson-databind versions before 2.8.10 or 2.9.1 using dependency management tools or examining JAR files

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind OR java -cp jackson-databind.jar com.fasterxml.jackson.databind.cfg.PackageVersion

Verify Fix Applied:

Verify jackson-databind version is 2.8.10 or later (2.9.1 for 2.9.x) and test deserialization with known malicious payloads

📡 Detection & Monitoring

Log Indicators:

Unusual deserialization errors
Stack traces containing ClassNotFoundException or NoClassDefFoundError for unexpected classes
Large or malformed JSON payloads in request logs

Network Indicators:

HTTP requests with JSON payloads containing unusual class names or serialized object patterns
Requests to JSON endpoints with content-types that trigger deserialization

SIEM Query:

source="web_logs" AND (http_method="POST" OR http_method="PUT") AND content_type="application/json" AND (url_path="*api*" OR url_path="*rest*") AND (payload CONTAINS "java.lang.Class" OR payload CONTAINS "com.sun.")

📊 Metadata

CVE ID: CVE-2017-15095

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-184

Published: February 6, 2018

Last Updated: November 21, 2024

🔗 References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch,Third Party Advisory
http://www.securityfocus.com/bid/103880 Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1039769 Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHSA-2017:3189 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3190 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0342 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0478 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0479 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0480 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0481 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0576 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0577 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1680 Issue Tracking,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1737 Issue Tracking,Patch,Third Party Advisory
https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20171214-0003/ Third Party Advisory
https://www.debian.org/security/2017/dsa-4037 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch,Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch,Third Party Advisory
http://www.securityfocus.com/bid/103880 Third Party Advisory,VDB Entry
http://www.securitytracker.com/id/1039769 Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHSA-2017:3189 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3190 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0342 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0478 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0479 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0480 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0481 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0576 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0577 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1447 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1448 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1449 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1450 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1451 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2858 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3149 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892 Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1680 Issue Tracking,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/1737 Issue Tracking,Patch,Third Party Advisory
https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20171214-0003/ Third Party Advisory
https://www.debian.org/security/2017/dsa-4037 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Clusterware by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Communications Diameter Signaling Router by Oracle

Communications Instant Messaging Server by Oracle

Database Server by Oracle

Database Server by Oracle

Debian Linux by Debian

Debian Linux by Debian

Enterprise Manager For Virtualization by Oracle

Enterprise Manager For Virtualization by Oracle

Enterprise Manager For Virtualization by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Global Lifecycle Management Opatchauto by Oracle

Identity Manager by Oracle

Identity Manager by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jd Edwards Enterpriseone Tools by Oracle

Oncommand Balance by Netapp

Oncommand Performance Manager by Netapp

Oncommand Performance Manager by Netapp

Oncommand Shift by Netapp

Openshift Container Platform by Redhat

Openshift Container Platform by Redhat

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Satellite by Redhat

Satellite Capsule by Redhat

Snapcenter by Netapp

Utilities Advanced Spatial And Operational Analytics by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Enable default typing blacklist

Input validation and filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities