CVE-2019-14379

Q: What is the severity of CVE-2019-14379?

CVE-2019-14379 has a CVSS score of 9.8 (CRITICAL). CVE-2019-14379 is a remote code execution vulnerability in FasterXML jackson-databind that occurs when default typing is enabled and ehcache is used. Attackers can exploit this by sending malicious JSON payloads to execute arbitrary code on vulnerable systems. This affects applications using jackson-databind with default typing enabled and ehcache dependency present.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

CVE-2019-14379 is a remote code execution vulnerability in FasterXML jackson-databind that occurs when default typing is enabled and ehcache is used. Attackers can exploit this by sending malicious JSON payloads to execute arbitrary code on vulnerable systems. This affects applications using jackson-databind with default typing enabled and ehcache dependency present.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind with ehcache

Versions: jackson-databind versions before 2.9.9.2

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ✅ No

Notes: Requires default typing to be enabled (ObjectMapper.enableDefaultTyping()) and ehcache dependency present. Not vulnerable in default configurations.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise allowing attackers to execute arbitrary code, steal data, install malware, or pivot to other systems.

🟠

Likely Case

Remote code execution leading to data theft, application compromise, or server takeover.

🟢

If Mitigated

Limited impact if default typing is disabled or proper input validation is implemented.

🌐 Internet-Facing: HIGH - Exploitable remotely without authentication via HTTP requests containing JSON payloads.

🏢 Internal Only: HIGH - Also exploitable internally via API calls or internal services processing JSON.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted JSON payloads to endpoints that deserialize JSON with default typing enabled.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: jackson-databind 2.9.9.2 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2389

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.9.2 or later. 2. Update pom.xml or build.gradle to use patched version. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable default typing

all

Disable default typing in ObjectMapper configuration to prevent polymorphic type handling

// Java code: objectMapper.disableDefaultTyping();

Remove ehcache dependency

all

Remove or update net.sf.ehcache dependency if not required

<!-- Maven: Remove <dependency> for ehcache -->
// Gradle: Remove 'net.sf.ehcache:ehcache' from dependencies

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs
Use network segmentation to isolate vulnerable systems and implement WAF rules to block suspicious JSON payloads

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for jackson-databind version < 2.9.9.2 and presence of ehcache dependency

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.9.2 or later in dependencies and test JSON deserialization functionality

📡 Detection & Monitoring

Log Indicators:

Unusual deserialization errors
Stack traces containing SubTypeValidator or DefaultTransactionManagerLookup
Unexpected process execution from Java application

Network Indicators:

HTTP requests with unusual JSON payloads containing class names
Outbound connections from application to unexpected destinations

SIEM Query:

source="application.logs" AND ("SubTypeValidator" OR "DefaultTransactionManagerLookup" OR "ehcache")

📊 Metadata

CVE ID: CVE-2019-14379

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-1321

Published: July 29, 2019

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Diameter Signaling Router by Oracle

Communications Instant Messaging Server by Oracle

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Financial Services Analytical Applications Infrastructure by Oracle

Goldengate Stream Analytics by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Oncommand Workflow Automation by Netapp

Openshift Container Platform by Redhat

Openshift Container Platform by Redhat

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Service Level Manager by Netapp

Siebel Engineering Installer \& Deployment by Oracle

Siebel Ui Framework by Oracle

Single Sign On by Redhat

Single Sign On by Redhat

Single Sign On by Redhat

Snapcenter by Netapp

Xcode by Apple

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing

Remove ehcache dependency

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators: