CVE-2020-10672

Q: What is the severity of CVE-2020-10672?

CVE-2020-10672 has a CVSS score of 8.8 (HIGH). CVE-2020-10672 is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when processing untrusted JSON content. It affects applications using jackson-databind 2.x before 2.9.10.4 with default polymorphic typing enabled. This impacts Java applications that deserialize JSON from untrusted sources.

8.8 HIGH

Remote Code Execution Deserialization

📋 TL;DR

CVE-2020-10672 is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when processing untrusted JSON content. It affects applications using jackson-databind 2.x before 2.9.10.4 with default polymorphic typing enabled. This impacts Java applications that deserialize JSON from untrusted sources.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON processing

Versions: 2.x before 2.9.10.4

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Requires polymorphic typing feature enabled (defaultObjectMapper.enableDefaultTyping() or similar).

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker achieves arbitrary code execution with application privileges, potentially leading to complete system compromise.

🟠

Likely Case

Remote code execution leading to data theft, privilege escalation, or lateral movement within the environment.

🟢

If Mitigated

Limited impact if proper input validation and security controls prevent exploitation attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending malicious JSON payloads to vulnerable endpoints.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.4 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2659

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10.4 or later. 2. Update Maven/Gradle configuration. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable polymorphic typing

all

Disable default typing features in ObjectMapper configuration

ObjectMapper mapper = new ObjectMapper();
// Do NOT call mapper.enableDefaultTyping()

Use allow-list for deserialization

all

Configure ObjectMapper to only allow specific classes during deserialization

mapper.activateDefaultTyping(ptv, ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
mapper.setPolymorphicTypeValidator(new DefaultPolymorphicTypeValidator.Builder().allowIfBaseType("com.example.").build());

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs
Use network segmentation and WAF rules to block suspicious JSON payloads

🔍 How to Verify

Check if Vulnerable:

Check pom.xml or build.gradle for jackson-databind version <2.9.10.4, or run: java -cp jackson-databind.jar com.fasterxml.jackson.databind.cfg.PackageVersion

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is >=2.9.10.4 in dependencies and deployed application

📡 Detection & Monitoring

Log Indicators:

Unusual deserialization errors
Stack traces containing org.apache.aries.transaction.jms
Unexpected class loading

Network Indicators:

HTTP POST requests with JSON payloads to API endpoints
Unusual outbound connections after JSON processing

SIEM Query:

source="application.logs" AND ("org.apache.aries.transaction.jms" OR "XaPooledConnectionFactory" OR "deserialization error")

📊 Metadata

CVE ID: CVE-2020-10672

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: March 18, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/FasterXML/jackson-databind/issues/2659 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2659 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Platform by Oracle

Communications Calendar Server by Oracle

Communications Contacts Server by Oracle

Communications Contacts Server by Oracle

Communications Diameter Signaling Router by Oracle

Communications Element Manager by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Network Charging And Control by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Debian Linux by Debian

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Price Creation And Discovery by Oracle

Financial Services Price Creation And Discovery by Oracle

Financial Services Retail Customer Analytics by Oracle

Global Lifecycle Management Opatch by Oracle

Insurance Policy Administration J2ee by Oracle

Insurance Policy Administration J2ee by Oracle

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Merchandising System by Oracle

Retail Sales Audit by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable polymorphic typing

Use allow-list for deserialization

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export