CVE-2020-10968

Q: What is the severity of CVE-2020-10968?

CVE-2020-10968 has a CVSS score of 8.8 (HIGH). This vulnerability in FasterXML jackson-databind allows remote code execution (RCE) via deserialization of untrusted data, exploiting a gadget chain involving org.aoju.bus.proxy.provider.remoting.RmiProvider. It affects applications using Jackson 2.x before 2.9.10.4 with default polymorphic typing enabled or specific configurations.

8.8 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution (RCE) via deserialization of untrusted data, exploiting a gadget chain involving org.aoju.bus.proxy.provider.remoting.RmiProvider. It affects applications using Jackson 2.x before 2.9.10.4 with default polymorphic typing enabled or specific configurations.

💻 Affected Systems

Products:

FasterXML jackson-databind

Versions: 2.x before 2.9.10.4

Operating Systems: All operating systems running Java applications with vulnerable Jackson versions

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires enabling polymorphic typing (e.g., with @JsonTypeInfo) or using specific deserialization features; default configurations in many frameworks may be vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

RCE allowing attackers to execute arbitrary commands on the server, potentially leading to data breaches or service disruption.

🟢

If Mitigated

Limited impact if input validation and deserialization controls are enforced, but risk persists without patching.

🌐 Internet-Facing: HIGH due to potential for unauthenticated exploitation via web APIs or services processing untrusted JSON.

🏢 Internal Only: MEDIUM as internal systems may still be vulnerable to insider threats or lateral movement.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploits leverage known gadget chains; public proof-of-concept code exists, making attacks straightforward for skilled adversaries.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.4 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2662

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10.4 or higher in your project's build configuration (e.g., Maven, Gradle). 2. Rebuild and redeploy the application. 3. Restart the application server to apply changes.

🔧 Temporary Workarounds

Disable polymorphic typing

all

Prevent deserialization of polymorphic types by disabling or restricting ObjectMapper configurations.

Configure ObjectMapper with disableDefaultTyping() or use a whitelist for allowed classes.

Block dangerous classes

all

Use Jackson's class blacklisting to block known malicious gadget classes.

Add org.aoju.bus.proxy.provider.remoting.RmiProvider and related classes to the deserialization blacklist in Jackson configuration.

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs to reject untrusted data.
Isolate the vulnerable application in a segmented network to limit potential lateral movement and monitor for anomalous activity.

🔍 How to Verify

Check if Vulnerable:

Check the jackson-databind version in your project dependencies; if it's below 2.9.10.4, you are vulnerable.

Check Version:

For Maven: mvn dependency:tree | grep jackson-databind; For Gradle: gradle dependencies | grep jackson-databind; In Java code: System.out.println(com.fasterxml.jackson.databind.cfg.PackageVersion.VERSION);

Verify Fix Applied:

After updating, verify the version is 2.9.10.4 or higher by checking the dependency manifest or running a version check command.

📡 Detection & Monitoring

Log Indicators:

Unusual deserialization errors, stack traces mentioning org.aoju.bus.proxy.provider.remoting.RmiProvider, or unexpected process spawns in application logs.

Network Indicators:

Suspicious inbound JSON payloads to APIs, especially with polymorphic type indicators, or outbound connections to unknown RMI services.

SIEM Query:

Example: source="app_logs" AND ("RmiProvider" OR "deserialization error")

📊 Metadata

CVE ID: CVE-2020-10968

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: March 26, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/FasterXML/jackson-databind/issues/2662 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2662 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Platform by Oracle

Communications Calendar Server by Oracle

Communications Contacts Server by Oracle

Communications Contacts Server by Oracle

Communications Diameter Signaling Router by Oracle

Communications Element Manager by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Network Charging And Control by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Debian Linux by Debian

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Institutional Performance Analytics by Oracle

Financial Services Price Creation And Discovery by Oracle

Financial Services Price Creation And Discovery by Oracle

Financial Services Retail Customer Analytics by Oracle

Global Lifecycle Management Opatch by Oracle

Insurance Policy Administration J2ee by Oracle

Insurance Policy Administration J2ee by Oracle

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Merchandising System by Oracle

Retail Sales Audit by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable polymorphic typing

Block dangerous classes

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export