CVE-2020-11619

Q: What is the severity of CVE-2020-11619?

CVE-2020-11619 has a CVSS score of 8.1 (HIGH). This is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when untrusted data is deserialized with polymorphic type handling enabled. It affects applications using jackson-databind 2.x before 2.9.10.4 that deserialize data from untrusted sources with default typing or @JsonTypeInfo annotations.

8.1 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This is a deserialization vulnerability in FasterXML jackson-databind that allows remote code execution when untrusted data is deserialized with polymorphic type handling enabled. It affects applications using jackson-databind 2.x before 2.9.10.4 that deserialize data from untrusted sources with default typing or @JsonTypeInfo annotations.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON deserialization
Spring Framework applications using jackson-databind

Versions: 2.x before 2.9.10.4

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when polymorphic type handling is enabled (default typing or @JsonTypeInfo) and untrusted data is deserialized.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with the privileges of the application, potentially leading to complete system compromise.

🟠

Likely Case

Remote code execution allowing attackers to execute arbitrary commands on the server.

🟢

If Mitigated

No impact if applications don't deserialize untrusted data or have proper type filtering in place.

🌐 Internet-Facing: HIGH - Internet-facing applications deserializing user input are directly exploitable.

🏢 Internal Only: MEDIUM - Internal applications could be exploited through lateral movement or compromised internal users.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires specific conditions but public PoCs exist. Attackers need to craft malicious JSON payloads targeting the MethodLocatingFactoryBean gadget.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.4 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2680

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10.4 or later. 2. Update pom.xml or build.gradle to use patched version. 3. Rebuild and redeploy application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable default typing

all

Disable polymorphic type handling (default typing) in ObjectMapper configuration

ObjectMapper mapper = new ObjectMapper();
mapper.activateDefaultTyping(null); // Disable default typing

Enable global default typing blacklist

all

Configure ObjectMapper to use the global default typing blacklist

ObjectMapper mapper = new ObjectMapper();
mapper.activateDefaultTyping(mapper.getPolymorphicTypeValidator(), ObjectMapper.DefaultTyping.NON_FINAL);

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON input
Use a Web Application Firewall (WAF) with deserialization attack detection rules

🔍 How to Verify

Check if Vulnerable:

Check pom.xml, build.gradle, or dependency manifest for jackson-databind version. If version is 2.x and < 2.9.10.4, you are vulnerable if using polymorphic type handling.

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.4 or later in dependencies and rebuild/redeploy application.

📡 Detection & Monitoring

Log Indicators:

Unusual Java class loading errors
Exceptions related to MethodLocatingFactoryBean or deserialization
Unexpected process spawning

Network Indicators:

Malformed JSON payloads containing Java class references
Requests with unusual content types or structures

SIEM Query:

source="application.logs" AND ("MethodLocatingFactoryBean" OR "deserialization" OR "jackson") AND severity=ERROR

📊 Metadata

CVE ID: CVE-2020-11619

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: April 7, 2020

Last Updated: November 21, 2024

🔗 References

https://github.com/FasterXML/jackson-databind/issues/2680 Issue Tracking,Patch,Third Party Advisory
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200511-0004/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2680 Issue Tracking,Patch,Third Party Advisory
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200511-0004/ Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Active Iq Unified Manager by Netapp

Agile Plm by Oracle

Banking Platform by Oracle

Communications Calendar Server by Oracle

Communications Contacts Server by Oracle

Communications Contacts Server by Oracle

Communications Diameter Signaling Router by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Network Charging And Control by Oracle

Debian Linux by Debian

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Global Lifecycle Management Opatch by Oracle

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Merchandising System by Oracle

Retail Sales Audit by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Steelstore Cloud Integrated Storage by Netapp

Weblogic Server by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing

Enable global default typing blacklist

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities