CVE-2020-14195
📋 TL;DR
This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code. Systems using jackson-databind 2.x with default polymorphic typing enabled are affected.
💻 Affected Systems
- FasterXML jackson-databind
- Applications using jackson-databind for JSON processing
📦 What is this software?
Agile Plm by Oracle
Communications Diameter Signaling Router by Oracle
View all CVEs affecting Communications Diameter Signaling Router →
Communications Evolved Communications Application Server by Oracle
View all CVEs affecting Communications Evolved Communications Application Server →
Communications Instant Messaging Server by Oracle
View all CVEs affecting Communications Instant Messaging Server →
Communications Session Report Manager by Oracle
View all CVEs affecting Communications Session Report Manager →
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution with the privileges of the application process, potentially allowing data exfiltration or service disruption.
If Mitigated
Denial of service or limited information disclosure if proper input validation and deserialization controls are in place.
🎯 Exploit Status
Exploitation requires the application to deserialize untrusted JSON with polymorphic typing enabled. The JndiRealmFactory gadget chain is specifically targeted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.10.5 or later
Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2765
Restart Required: Yes
Instructions:
1. Update jackson-databind dependency to version 2.9.10.5 or later. 2. Update Maven/Gradle configuration to use patched version. 3. Restart affected applications. 4. Verify no older vulnerable versions remain in dependency tree.
🔧 Temporary Workarounds
Disable polymorphic typing
allDisable default typing features if not required for application functionality
Remove calls to enableDefaultTyping() from ObjectMapper configuration
Block JndiRealmFactory class
allAdd JndiRealmFactory to the list of blocked deserialization classes
ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(); mapper.addMixIn(Object.class, MyMixInForIgnoreType.class);
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all JSON inputs
- Use network segmentation to isolate vulnerable systems and limit attack surface
🔍 How to Verify
Check if Vulnerable:
Check pom.xml or build.gradle for jackson-databind version <2.9.10.5. Run: mvn dependency:tree | grep jackson-databind or gradle dependencies | grep jackson-databindCheck Version:
mvn dependency:tree | grep jackson-databindVerify Fix Applied:
Verify jackson-databind version is 2.9.10.5 or higher in dependency tree. Test application with known malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors
- JNDI lookup attempts in logs
- Unexpected class loading
Network Indicators:
- Unexpected outbound LDAP connections from application servers
- Suspicious JSON payloads containing type information
SIEM Query:
source="application.log" AND ("JndiRealmFactory" OR "enableDefaultTyping" OR "Jackson deserialization")🔗 References
- https://github.com/FasterXML/jackson-databind/issues/2765
- https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- https://security.netapp.com/advisory/ntap-20200702-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/FasterXML/jackson-databind/issues/2765
- https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
- https://security.netapp.com/advisory/ntap-20200702-0003/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
