CVE-2019-16335

Q: What is the severity of CVE-2019-16335?

CVE-2019-16335 has a CVSS score of 9.8 (CRITICAL). CVE-2019-16335 is a deserialization vulnerability in Jackson databind that allows remote code execution through polymorphic type handling. Attackers can exploit this by sending malicious JSON payloads to applications using vulnerable Jackson versions with HikariCP on the classpath. This affects any Java application using Jackson databind for JSON processing.

9.8 CRITICAL

Remote Code Execution Deserialization

📋 TL;DR

CVE-2019-16335 is a deserialization vulnerability in Jackson databind that allows remote code execution through polymorphic type handling. Attackers can exploit this by sending malicious JSON payloads to applications using vulnerable Jackson versions with HikariCP on the classpath. This affects any Java application using Jackson databind for JSON processing.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using Jackson with HikariCP

Versions: jackson-databind versions before 2.9.10

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Requires com.zaxxer.hikari.HikariDataSource on classpath. Many Java web applications and frameworks use Jackson for JSON processing.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with full system compromise, allowing attackers to execute arbitrary commands, install malware, or exfiltrate sensitive data.

🟠

Likely Case

Remote code execution leading to application compromise, data theft, and potential lateral movement within the network.

🟢

If Mitigated

Limited impact with proper input validation, network segmentation, and minimal privileges, potentially reducing to denial of service.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted JSON to endpoints that deserialize untrusted data. Public exploit code exists.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: jackson-databind 2.9.10 or later

Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:3200

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10 or later. 2. Update Maven/Gradle dependencies. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Block HikariCP classes

all

Remove or block com.zaxxer.hikari.HikariDataSource from classpath to prevent exploitation

Remove HikariCP JAR files from classpath or application deployment

Input validation and filtering

all

Implement strict input validation and reject JSON containing suspicious type information

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable applications
Deploy web application firewall with JSON deserialization protection rules

🔍 How to Verify

Check if Vulnerable:

Check pom.xml or build.gradle for jackson-databind version <2.9.10 and verify HikariCP is in classpath

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10+ in dependencies and test with known exploit payloads

📡 Detection & Monitoring

Log Indicators:

Java stack traces containing com.fasterxml.jackson.databind, ClassNotFoundException, or suspicious deserialization errors
Unexpected process execution or network connections from Java applications

Network Indicators:

HTTP requests with JSON payloads containing type information or class names
Unusual outbound connections from application servers

SIEM Query:

source="application.logs" AND ("jackson" OR "deserialization" OR "HikariDataSource") AND (error OR exception)

📊 Metadata

CVE ID: CVE-2019-16335

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: September 15, 2019

Last Updated: November 21, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Customer Management And Segmentation Foundation by Oracle

Debian Linux by Debian

Debian Linux by Debian

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Financial Services Analytical Applications Infrastructure by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Global Lifecycle Management Opatch by Oracle

Goldengate Application Adapters by Oracle

Goldengate Stream Analytics by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Oncommand Api Services by Netapp

Oncommand Workflow Automation by Netapp

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Block HikariCP classes

Input validation and filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities