CVE-2018-19360
📋 TL;DR
This vulnerability in FasterXML jackson-databind allows remote code execution through polymorphic deserialization of untrusted data. Attackers can exploit the axis2-transport-jms class to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind for JSON deserialization is affected.
💻 Affected Systems
- FasterXML jackson-databind
📦 What is this software?
Business Process Management Suite by Oracle
Business Process Management Suite by Oracle
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
Primavera P6 Enterprise Project Portfolio Management by Oracle
View all CVEs affecting Primavera P6 Enterprise Project Portfolio Management →
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution with the privileges of the application processing JSON data, potentially leading to application compromise and data exposure.
If Mitigated
Limited impact if proper input validation and deserialization controls are implemented, potentially reduced to denial of service.
🎯 Exploit Status
Exploitation requires the application to deserialize untrusted JSON data. Public exploit code exists for similar jackson-databind vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.8 or later
Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2186
Restart Required: Yes
Instructions:
1. Update jackson-databind dependency to version 2.9.8 or later. 2. Update Maven/Gradle configuration. 3. Rebuild and redeploy application. 4. Restart application server.
🔧 Temporary Workarounds
Block axis2-transport-jms class
allAdd axis2-transport-jms to the default typing deny list in Jackson configuration
ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(); mapper.setDefaultTyping(new DefaultTypeResolverBuilder(DefaultTyping.NON_FINAL) { @Override public boolean isTypeIdResolvable() { return false; } });
Disable default typing
allDisable polymorphic deserialization features if not required
ObjectMapper mapper = new ObjectMapper(); mapper.disableDefaultTyping();
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all JSON inputs
- Use allow-listing for deserialization classes instead of default typing
🔍 How to Verify
Check if Vulnerable:
Check pom.xml or build.gradle for jackson-databind version <2.9.8, or run: java -cp jackson-databind.jar com.fasterxml.jackson.databind.ObjectMapper --versionCheck Version:
mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databindVerify Fix Applied:
Verify jackson-databind version is 2.9.8 or higher in dependencies, and test JSON deserialization with malicious payloads📡 Detection & Monitoring
Log Indicators:
- Java exceptions related to ClassNotFoundException, NoClassDefFoundError, or deserialization errors
- Unusual process execution from Java applications
Network Indicators:
- HTTP requests with unusual JSON payloads containing type information
- Outbound connections from Java processes to unexpected destinations
SIEM Query:
source="application.log" AND ("ClassNotFoundException" OR "NoClassDefFoundError") AND "axis2-transport-jms"🔗 References
- http://www.securityfocus.com/bid/107985
- https://access.redhat.com/errata/RHBA-2019:0959
- https://access.redhat.com/errata/RHSA-2019:0782
- https://access.redhat.com/errata/RHSA-2019:0877
- https://access.redhat.com/errata/RHSA-2019:1782
- https://access.redhat.com/errata/RHSA-2019:1797
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- https://github.com/FasterXML/jackson-databind/issues/2186
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html
- https://seclists.org/bugtraq/2019/May/68
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.debian.org/security/2019/dsa-4452
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- http://www.securityfocus.com/bid/107985
- https://access.redhat.com/errata/RHBA-2019:0959
- https://access.redhat.com/errata/RHSA-2019:0782
- https://access.redhat.com/errata/RHSA-2019:0877
- https://access.redhat.com/errata/RHSA-2019:1782
- https://access.redhat.com/errata/RHSA-2019:1797
- https://access.redhat.com/errata/RHSA-2019:1822
- https://access.redhat.com/errata/RHSA-2019:1823
- https://access.redhat.com/errata/RHSA-2019:2804
- https://access.redhat.com/errata/RHSA-2019:2858
- https://access.redhat.com/errata/RHSA-2019:3002
- https://access.redhat.com/errata/RHSA-2019:3140
- https://access.redhat.com/errata/RHSA-2019:3149
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4037
- https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b
- https://github.com/FasterXML/jackson-databind/issues/2186
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8
- https://issues.apache.org/jira/browse/TINKERPOP-2121
- https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html
- https://seclists.org/bugtraq/2019/May/68
- https://security.netapp.com/advisory/ntap-20190530-0003/
- https://www.debian.org/security/2019/dsa-4452
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
