CVE-2019-14540

Q: What is the severity of CVE-2019-14540?

CVE-2019-14540 has a CVSS score of 9.8 (CRITICAL). CVE-2019-14540 is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution through polymorphic type handling. Attackers can exploit this by sending malicious JSON payloads that trigger the deserialization of dangerous classes. Applications using jackson-databind with HikariCP or similar libraries are affected.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

CVE-2019-14540 is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution through polymorphic type handling. Attackers can exploit this by sending malicious JSON payloads that trigger the deserialization of dangerous classes. Applications using jackson-databind with HikariCP or similar libraries are affected.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind with HikariCP

Versions: Versions before 2.9.10

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires jackson-databind to be configured to allow polymorphic type handling with certain dangerous classes enabled.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full remote code execution with the privileges of the application, potentially leading to complete system compromise, data theft, and lateral movement.

🟠

Likely Case

Remote code execution leading to application compromise, data exfiltration, and potential privilege escalation within the affected environment.

🟢

If Mitigated

Limited impact with proper input validation, network segmentation, and minimal privileges, potentially reducing to denial of service or information disclosure.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted JSON payloads to endpoints that deserialize untrusted data. Multiple proof-of-concept exploits are publicly available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10 or later

Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:3200

Restart Required: Yes

Instructions:

1. Identify all applications using jackson-databind. 2. Update jackson-databind dependency to version 2.9.10 or later. 3. Rebuild and redeploy affected applications. 4. Restart application servers.

🔧 Temporary Workarounds

Disable polymorphic type handling

all

Configure Jackson ObjectMapper to disable default typing and polymorphic type handling for untrusted sources.

ObjectMapper mapper = new ObjectMapper();
mapper.enableDefaultTyping(); // Remove or disable this line
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);

Block dangerous classes

all

Use Jackson's SubTypeValidator to block known dangerous classes from being deserialized.

SimpleModule module = new SimpleModule();
module.setMixInAnnotation(HikariConfig.class, BlockHikariConfigMixin.class);
mapper.registerModule(module);

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs.
Deploy network segmentation and WAF rules to block malicious payloads targeting this vulnerability.

🔍 How to Verify

Check if Vulnerable:

Check Maven/Gradle dependencies for jackson-databind versions <2.9.10. Use: mvn dependency:tree | grep jackson-databind or gradle dependencies | grep jackson-databind.

Check Version:

mvn dependency:tree | grep jackson-databind || gradle dependencies | grep jackson-databind || find . -name "*.jar" -exec jar tf {} \; | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is >=2.9.10 in dependency files and deployed artifacts. Test with known exploit payloads to ensure they are rejected.

📡 Detection & Monitoring

Log Indicators:

Java stack traces containing 'com.fasterxml.jackson.databind' with deserialization errors
Unusual class loading attempts for HikariConfig or similar classes
Large or malformed JSON payloads in request logs

Network Indicators:

HTTP requests with JSON payloads containing type information fields
Requests to JSON endpoints with unusual content types or headers

SIEM Query:

source="application.logs" AND ("jackson.databind" OR "HikariConfig") AND ("deserialization" OR "ClassNotFoundException" OR "InvalidTypeIdException")

📊 Metadata

CVE ID: CVE-2019-14540

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: September 15, 2019

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Customer Management And Segmentation Foundation by Oracle

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Financial Services Analytical Applications Infrastructure by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Goldengate Application Adapters by Oracle

Goldengate Stream Analytics by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Mysql by Oracle

Mysql by Oracle

Oncommand Api Services by Netapp

Oncommand Workflow Automation by Netapp

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable polymorphic type handling

Block dangerous classes

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities