CVE-2018-19362

Q: What is the severity of CVE-2018-19362?

CVE-2018-19362 has a CVSS score of 9.8 (CRITICAL). This vulnerability in FasterXML jackson-databind allows remote code execution through polymorphic deserialization attacks targeting the jboss-common-core class. Attackers can exploit this to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind for JSON deserialization is potentially affected.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution through polymorphic deserialization attacks targeting the jboss-common-core class. Attackers can exploit this to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind for JSON deserialization is potentially affected.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON processing

Versions: 2.x before 2.9.8

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists when applications deserialize untrusted JSON data using jackson-databind with default polymorphic typing configurations.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.

🟠

Likely Case

Remote code execution allowing attackers to run arbitrary commands with the privileges of the application process.

🟢

If Mitigated

Limited impact if proper input validation and deserialization controls are implemented, potentially reduced to denial of service.

🌐 Internet-Facing: HIGH - Exploitable remotely without authentication, affecting internet-facing applications directly.

🏢 Internal Only: MEDIUM - Still exploitable by internal attackers or through compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the application to deserialize untrusted JSON data. Public proof-of-concept code exists demonstrating the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.8 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2186

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.8 or later. 2. Update Maven/Gradle dependencies accordingly. 3. Rebuild and redeploy affected applications. 4. Restart application servers.

🔧 Temporary Workarounds

Disable polymorphic deserialization

all

Configure ObjectMapper to disable default typing and polymorphic deserialization features

ObjectMapper mapper = new ObjectMapper();
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);
mapper.enableDefaultTyping(DefaultTyping.NON_FINAL); // Avoid this

Input validation and filtering

all

Implement strict input validation and filter untrusted JSON data before deserialization

// Implement custom deserializers or filters
// Use @JsonTypeInfo with explicit type definitions only

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable applications from untrusted networks
Deploy web application firewalls (WAF) with JSON deserialization attack detection rules

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for jackson-databind versions below 2.9.8. Review Maven pom.xml or Gradle build files.

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.8 or higher in application dependencies and runtime classpath.

📡 Detection & Monitoring

Log Indicators:

Unexpected deserialization errors
Stack traces containing jboss-common-core or related classes
Unusual process execution from application context

Network Indicators:

Malformed JSON payloads targeting deserialization endpoints
Unexpected outbound connections from application servers

SIEM Query:

source="application.logs" AND ("jboss-common-core" OR "deserialization error" OR "ObjectMapper")

📊 Metadata

CVE ID: CVE-2018-19362

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: January 2, 2019

Last Updated: November 21, 2024

🔗 References

http://www.securityfocus.com/bid/107985 Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0877 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1797 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:3002
https://access.redhat.com/errata/RHSA-2019:3140
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3892
https://access.redhat.com/errata/RHSA-2019:4037
https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2186 Issue Tracking,Patch,Third Party Advisory
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8 Patch,Release Notes,Third Party Advisory
https://issues.apache.org/jira/browse/TINKERPOP-2121 Issue Tracking,Third Party Advisory
https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Mailing List,Third Party Advisory
https://seclists.org/bugtraq/2019/May/68 Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
http://www.securityfocus.com/bid/107985 Third Party Advisory,VDB Entry
https://access.redhat.com/errata/RHBA-2019:0959 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0877 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1782 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1797 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1822 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1823 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2804
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:3002
https://access.redhat.com/errata/RHSA-2019:3140
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3892
https://access.redhat.com/errata/RHSA-2019:4037
https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2186 Issue Tracking,Patch,Third Party Advisory
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8 Patch,Release Notes,Third Party Advisory
https://issues.apache.org/jira/browse/TINKERPOP-2121 Issue Tracking,Third Party Advisory
https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html Mailing List,Third Party Advisory
https://seclists.org/bugtraq/2019/May/68 Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20190530-0003/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4452 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch,Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Automation Manager by Redhat

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Debian Linux by Debian

Decision Manager by Redhat

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jboss Bpm Suite by Redhat

Jboss Brms by Redhat

Openshift Container Platform by Redhat

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera P6 Enterprise Project Portfolio Management by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Workforce Management Software by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable polymorphic deserialization

Input validation and filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities