CVE-2020-35491

Q: What is the severity of CVE-2020-35491?

CVE-2020-35491 has a CVSS score of 8.1 (HIGH). This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind with default or permissive deserialization settings is affected.

8.1 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind with default or permissive deserialization settings is affected.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON processing
Apache Commons DBCP2

Versions: 2.x before 2.9.10.8

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires enabling default typing or polymorphic type handling features. Applications using permissive deserialization configurations are most vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.

🟠

Likely Case

Application compromise allowing attackers to execute arbitrary code within the application context, potentially accessing sensitive data or disrupting services.

🟢

If Mitigated

Limited impact if proper input validation and deserialization controls are in place, potentially resulting in denial of service at worst.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires specific conditions but has been demonstrated in proof-of-concept code. The vulnerability leverages known gadget chains.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.8 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2986

Restart Required: Yes

Instructions:

1. Identify all applications using jackson-databind. 2. Update jackson-databind dependency to version 2.9.10.8 or later. 3. Rebuild and redeploy affected applications. 4. Restart services using the updated libraries.

🔧 Temporary Workarounds

Disable default typing

all

Configure Jackson ObjectMapper to disable default typing and polymorphic type handling features

ObjectMapper mapper = new ObjectMapper();
mapper.deactivateDefaultTyping();
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);

Block dangerous classes

all

Use Jackson's SubTypeValidator to block deserialization of dangerous classes

SimpleModule module = new SimpleModule();
module.setMixInAnnotation(SharedPoolDataSource.class, NoClass.class);
mapper.registerModule(module);

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs
Deploy network segmentation and application firewalls to restrict access to vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check Maven/Gradle dependencies for jackson-databind version <2.9.10.8. Review application configuration for default typing or polymorphic type handling.

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.8 or later in dependency files and runtime classpath. Test deserialization with known malicious payloads.

📡 Detection & Monitoring

Log Indicators:

Unusual deserialization errors
Stack traces containing SharedPoolDataSource or related classes
Unexpected class loading

Network Indicators:

Unusual JSON payloads with type information
Requests attempting to trigger deserialization

SIEM Query:

source="application.logs" AND ("SharedPoolDataSource" OR "deserialization error" OR "ClassNotFoundException")

📊 Metadata

CVE ID: CVE-2020-35491

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: December 17, 2020

Last Updated: November 21, 2024

🔗 References

https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2986 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210122-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2986 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210122-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Application Testing Suite by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Treasury Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Blockchain Platform by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Diameter Signaling Route by Oracle

Communications Diameter Signaling Route by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Offline Mediation Controller by Oracle

Communications Pricing Design Center by Oracle

Communications Services Gatekeeper by Oracle

Communications Unified Inventory Management by Oracle

Debian Linux by Debian

Documaker by Oracle

Documaker by Oracle

Insurance Policy Administration J2ee by Oracle

Jackson Databind by Fasterxml

Retail Customer Management And Segmentation Foundation by Oracle

Retail Merchandising System by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Sd Wan Edge by Oracle

Service Level Manager by Netapp

Webcenter Portal by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing

Block dangerous classes

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities