CVE-2020-14062
📋 TL;DR
This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code when processing malicious JSON payloads. Affected systems include any application using vulnerable versions of jackson-databind with polymorphic type handling enabled.
💻 Affected Systems
- FasterXML jackson-databind
- Applications using jackson-databind for JSON processing
📦 What is this software?
Agile Plm by Oracle
Communications Diameter Signaling Router by Oracle
View all CVEs affecting Communications Diameter Signaling Router →
Communications Evolved Communications Application Server by Oracle
View all CVEs affecting Communications Evolved Communications Application Server →
Communications Session Report Manager by Oracle
View all CVEs affecting Communications Session Report Manager →
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution with the privileges of the application processing JSON data, potentially leading to application takeover.
If Mitigated
Limited impact if proper input validation and deserialization controls are in place, potentially resulting in denial of service.
🎯 Exploit Status
Exploitation requires sending malicious JSON payloads to endpoints that deserialize with polymorphic type handling enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.10.5 or later
Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2704
Restart Required: Yes
Instructions:
1. Update jackson-databind dependency to version 2.9.10.5 or later. 2. Update Maven/Gradle dependencies accordingly. 3. Restart affected applications. 4. Verify no older vulnerable versions remain in the dependency tree.
🔧 Temporary Workarounds
Disable polymorphic type handling
allDisable default typing and avoid @JsonTypeInfo annotations in vulnerable configurations
Configure ObjectMapper with disableDefaultTyping()
Block JNDI connections
allConfigure JVM to disable JNDI lookups from untrusted sources
-Dcom.sun.jndi.ldap.object.trustURLCodebase=false
-Dcom.sun.jndi.rmi.object.trustURLCodebase=false
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all JSON inputs
- Use allow-listing for deserialization classes instead of block-listing
🔍 How to Verify
Check if Vulnerable:
Check pom.xml or build.gradle for jackson-databind version <2.9.10.5, or run: mvn dependency:tree | grep jackson-databindCheck Version:
mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databindVerify Fix Applied:
Verify jackson-databind version is 2.9.10.5 or higher in dependency tree📡 Detection & Monitoring
Log Indicators:
- Unusual JNDI connection attempts
- Exceptions related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool
- Stack traces containing deserialization errors
Network Indicators:
- Unusual outbound LDAP/RMI connections from application servers
- Large or malformed JSON payloads to API endpoints
SIEM Query:
source="application.logs" AND ("JNDIConnectionPool" OR "xalan2" OR "jackson.databind")🔗 References
- https://github.com/FasterXML/jackson-databind/issues/2704
- https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20200702-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/FasterXML/jackson-databind/issues/2704
- https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20200702-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
