CVE-2020-11111

Q: What is the severity of CVE-2020-11111?

CVE-2020-11111 has a CVSS score of 8.8 (HIGH). This CVE allows remote code execution through deserialization of untrusted data in FasterXML jackson-databind. It affects applications using Jackson 2.x with default typing enabled that process serialized data from untrusted sources. The vulnerability exploits interaction between serialization gadgets and typing features.

8.8 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This CVE allows remote code execution through deserialization of untrusted data in FasterXML jackson-databind. It affects applications using Jackson 2.x with default typing enabled that process serialized data from untrusted sources. The vulnerability exploits interaction between serialization gadgets and typing features.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using Jackson for JSON/XML processing

Versions: 2.x before 2.9.10.4

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when default typing is enabled (ObjectMapper.enableDefaultTyping() or similar) and processing untrusted data.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker achieves arbitrary code execution with the privileges of the application, potentially leading to complete system compromise.

🟠

Likely Case

Remote code execution leading to data theft, lateral movement, or deployment of malware.

🟢

If Mitigated

Limited impact if proper input validation and deserialization controls are implemented.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires specific conditions but has been demonstrated in proof-of-concepts.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.4 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2664

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to 2.9.10.4 or later. 2. Update Maven/Gradle dependencies accordingly. 3. Restart affected applications.

🔧 Temporary Workarounds

Disable default typing

all

Disable polymorphic type handling (default typing) in Jackson ObjectMapper configuration

// Java code: objectMapper.disableDefaultTyping();

Use safe typing

all

Configure Jackson to use specific safe typing modes instead of default typing

// Java code: objectMapper.activateDefaultTyping(LaissezFaireSubTypeValidator.instance, ObjectMapper.DefaultTyping.NON_FINAL);

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON/XML inputs
Use application-level firewalls or WAFs to block suspicious deserialization patterns

🔍 How to Verify

Check if Vulnerable:

Check pom.xml or build.gradle for jackson-databind version <2.9.10.4, or run: java -cp jackson-databind.jar com.fasterxml.jackson.databind.cfg.PackageVersion

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.4 or higher in dependency files

📡 Detection & Monitoring

Log Indicators:

Unusual Java class loading patterns
Exceptions related to deserialization failures
Suspicious network connections after JSON processing

Network Indicators:

Unusual JSON payloads containing Java class names
Requests triggering deserialization errors

SIEM Query:

source="application.logs" AND ("DefaultTyping" OR "deserialization" OR "jackson") AND (error OR exception)

📊 Metadata

CVE ID: CVE-2020-11111

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: March 31, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/FasterXML/jackson-databind/issues/2664 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2664 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200403-0002/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Digital Experience by Oracle

Banking Platform by Oracle

Communications Calendar Server by Oracle

Communications Contacts Server by Oracle

Communications Contacts Server by Oracle

Communications Diameter Signaling Router by Oracle

Communications Element Manager by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Network Charging And Control by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Debian Linux by Debian

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Global Lifecycle Management Opatch by Oracle

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Merchandising System by Oracle

Retail Sales Audit by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing

Use safe typing

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities