CVE-2020-36180

Q: What is the severity of CVE-2020-36180?

CVE-2020-36180 has a CVSS score of 8.1 (HIGH). This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. It affects applications using jackson-databind 2.x before 2.9.10.8 with default polymorphic typing enabled. Attackers can exploit this by sending malicious JSON payloads to vulnerable endpoints.

8.1 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. It affects applications using jackson-databind 2.x before 2.9.10.8 with default polymorphic typing enabled. Attackers can exploit this by sending malicious JSON payloads to vulnerable endpoints.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind for JSON processing
Apache Commons DBCP2 integration

Versions: 2.x before 2.9.10.8

Operating Systems: All operating systems running Java applications

Default Config Vulnerable: ⚠️ Yes

Notes: Requires polymorphic typing to be enabled (defaultObjectMapper.enableDefaultTyping() or similar). Applications using jackson-databind with Apache Commons DBCP2 are particularly vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with remote code execution as the application user, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Remote code execution on the vulnerable application server, allowing attackers to execute arbitrary commands, access sensitive data, or disrupt services.

🟢

If Mitigated

Denial of service or application crash if exploitation attempts are blocked by security controls.

🌐 Internet-Facing: HIGH - Web applications accepting JSON input are directly exposed to exploitation attempts from the internet.

🏢 Internal Only: MEDIUM - Internal applications are still vulnerable but require network access; risk depends on internal segmentation and user privileges.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted JSON to endpoints that deserialize untrusted data. Public proof-of-concept code exists in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.8 or later (2.10.x, 2.11.x, 2.12.x)

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/3004

Restart Required: Yes

Instructions:

1. Identify all applications using jackson-databind. 2. Update jackson-databind dependency to version 2.9.10.8 or later. 3. For Maven: update pom.xml <jackson.version> property. 4. For Gradle: update build.gradle dependencies. 5. Rebuild and redeploy applications. 6. Restart affected services.

🔧 Temporary Workarounds

Disable default typing

all

Disable polymorphic type handling in ObjectMapper configuration

ObjectMapper mapper = new ObjectMapper();
mapper.deactivateDefaultTyping();

Block dangerous classes

all

Use SubTypeValidator to block deserialization of dangerous classes

SimpleModule module = new SimpleModule();
module.setMixInAnnotation(org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.class, NoClass.class);

🧯 If You Can't Patch

Implement strict input validation and sanitization for all JSON inputs
Use network segmentation and WAF rules to block malicious payloads containing DriverAdapterCPDS references

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for jackson-databind version <2.9.10.8. Review code for enableDefaultTyping() usage.

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.8 or later in dependency manifests and runtime classpath.

📡 Detection & Monitoring

Log Indicators:

Java stack traces containing DriverAdapterCPDS, ClassNotFoundException for gadget classes
Unusual deserialization errors in application logs

Network Indicators:

HTTP requests with JSON payloads containing DriverAdapterCPDS class references
Unusual outbound connections from application servers

SIEM Query:

source="*app.log*" AND "DriverAdapterCPDS" OR source="*web.log*" AND "POST" AND "application/json" AND size>10000

📊 Metadata

CVE ID: CVE-2020-36180

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: January 7, 2021

Last Updated: November 21, 2024

🔗 References

https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/3004 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/3004 Issue Tracking,Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Application Testing Suite by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Extensibility Workbench by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Supply Chain Finance by Oracle

Banking Treasury Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Blockchain Platform by Oracle

Cloud Backup by Netapp

Commerce Platform by Oracle

Commerce Platform by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Convergent Charging Controller by Oracle

Communications Diameter Signaling Route by Oracle

Communications Element Manager by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Offline Mediation Controller by Oracle

Communications Policy Management by Oracle

Communications Pricing Design Center by Oracle

Communications Services Gatekeeper by Oracle

Communications Session Report Manager by Oracle

Communications Session Route Manager by Oracle

Communications Unified Inventory Management by Oracle

Data Integrator by Oracle

Debian Linux by Debian

Documaker by Oracle

Documaker by Oracle

Documaker by Oracle

Goldengate Application Adapters by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Merchandising System by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Service Level Manager by Netapp

Webcenter Portal by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case