CVE-2020-35728

Q: What is the severity of CVE-2020-35728?

CVE-2020-35728 has a CVSS score of 8.1 (HIGH). This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind with default or polymorphic typing enabled is at risk.

8.1 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Any application using vulnerable versions of jackson-databind with default or polymorphic typing enabled is at risk.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON processing
Oracle WebLogic Server
Various Java applications with embedded Xalan

Versions: jackson-databind 2.x before 2.9.10.8

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires default polymorphic typing or explicit enabling of default typing; affects applications that deserialize untrusted JSON data.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.

🟠

Likely Case

Remote code execution allowing attackers to run arbitrary commands, install malware, or exfiltrate sensitive data.

🟢

If Mitigated

Limited impact if proper input validation, deserialization controls, and network segmentation are implemented.

🌐 Internet-Facing: HIGH - Internet-facing applications can be directly exploited without authentication.

🏢 Internal Only: MEDIUM - Internal applications still vulnerable but require network access; could be exploited via phishing or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploit requires sending specially crafted JSON payloads to vulnerable endpoints; multiple public PoCs exist demonstrating the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: jackson-databind 2.9.10.8 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2999

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10.8 or later. 2. Update Maven/Gradle dependencies accordingly. 3. Rebuild and redeploy affected applications. 4. Restart application servers.

🔧 Temporary Workarounds

Disable default typing

all

Disable polymorphic type handling in Jackson ObjectMapper configuration

ObjectMapper mapper = new ObjectMapper();
mapper.deactivateDefaultTyping();
mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);

Block JNDIConnectionPool class

all

Add JNDIConnectionPool to the default typing blacklist

SimpleModule module = new SimpleModule();
module.addDeserializer(Object.class, new BlacklistDeserializer());
// Add com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool to blacklist

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs
Use network segmentation to isolate vulnerable applications from critical systems
Deploy WAF rules to block malicious JSON payloads
Monitor for unusual deserialization patterns and failed JSON parsing

🔍 How to Verify

Check if Vulnerable:

Check pom.xml or build.gradle for jackson-databind version <2.9.10.8, or run: java -cp jackson-databind-*.jar com.fasterxml.jackson.databind.ObjectMapper --version

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.8 or higher in dependencies, test JSON deserialization with known malicious payloads

📡 Detection & Monitoring

Log Indicators:

Failed JSON deserialization attempts
Unusual class loading patterns
JNDI lookup attempts in logs
Stack traces containing JNDIConnectionPool or related classes

Network Indicators:

Unusual JSON payloads with type information
Requests containing polymorphic type indicators
Outbound LDAP/JNDI connections from application servers

SIEM Query:

source="application.logs" AND ("JNDIConnectionPool" OR "com.oracle.wls.shaded" OR "DefaultTyping" OR "PolymorphicTypeValidator")

📊 Metadata

CVE ID: CVE-2020-35728

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: December 27, 2020

Last Updated: August 27, 2025

🔗 References

https://github.com/FasterXML/jackson-databind/issues/2999 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20210129-0007/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2999 Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20210129-0007/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Application Testing Suite by Oracle

Autovue by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Treasury Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Blockchain Platform by Oracle

Commerce Platform by Oracle

Commerce Platform by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Convergent Charging Controller by Oracle

Communications Diameter Signaling Route by Oracle

Communications Element Manager by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Network Charging And Control by Oracle

Communications Policy Management by Oracle

Communications Services Gatekeeper by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Communications Unified Inventory Management by Oracle

Data Integrator by Oracle

Debian Linux by Debian

Goldengate Application Adapters by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Merchandising System by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Service Level Manager by Netapp

Webcenter Portal by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing

Block JNDIConnectionPool class

🧯 If You Can't Patch