CVE-2020-36189

Q: What is the severity of CVE-2020-36189?

CVE-2020-36189 has a CVSS score of 8.1 (HIGH). This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Applications using jackson-databind for JSON processing with polymorphic type handling enabled are vulnerable.

8.1 HIGH

Remote Code Execution Deserialization

📋 TL;DR

This vulnerability in FasterXML jackson-databind allows remote code execution through deserialization of untrusted data. Attackers can exploit the interaction between serialization gadgets and typing features to execute arbitrary code on affected systems. Applications using jackson-databind for JSON processing with polymorphic type handling enabled are vulnerable.

💻 Affected Systems

Products:

FasterXML jackson-databind
Applications using jackson-databind library

Versions: 2.x before 2.9.10.8

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Requires polymorphic type handling (default typing) to be enabled. Default configurations without this feature are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.

🟠

Likely Case

Remote code execution allowing attackers to run arbitrary commands, install malware, or pivot to other systems.

🟢

If Mitigated

Denial of service or application crash if exploitation attempts are blocked by security controls.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires the application to deserialize untrusted JSON with polymorphic type handling enabled. The specific gadget chain involves com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.9.10.8 or later

Vendor Advisory: https://github.com/FasterXML/jackson-databind/issues/2996

Restart Required: Yes

Instructions:

1. Update jackson-databind dependency to version 2.9.10.8 or later. 2. Update pom.xml or build.gradle to reference the patched version. 3. Rebuild and redeploy the application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable default typing

all

Disable polymorphic type handling (default typing) in ObjectMapper configuration

ObjectMapper mapper = new ObjectMapper();
mapper.activateDefaultTyping(null); // Disable default typing

Block specific classes

all

Add com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource to denylist

SimpleModule module = new SimpleModule();
module.setMixInAnnotation(DriverManagerConnectionSource.class, NoClass.class);

🧯 If You Can't Patch

Disable default typing in ObjectMapper configuration
Implement input validation and sanitization for JSON deserialization

🔍 How to Verify

Check if Vulnerable:

Check application dependencies for jackson-databind version 2.x < 2.9.10.8

Check Version:

mvn dependency:tree | grep jackson-databind OR gradle dependencies | grep jackson-databind

Verify Fix Applied:

Verify jackson-databind version is 2.9.10.8 or higher in dependencies

📡 Detection & Monitoring

Log Indicators:

Java exceptions related to deserialization
ClassNotFoundExceptions for suspicious classes
Unexpected process execution

Network Indicators:

Unusual outbound connections from application servers
HTTP requests with malicious JSON payloads

SIEM Query:

source="application.logs" AND ("com.newrelic.agent.deps" OR "DriverManagerConnectionSource" OR "jackson.databind")

📊 Metadata

CVE ID: CVE-2020-36189

CVSS v3 Score: 8.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: January 6, 2021

Last Updated: November 21, 2024

🔗 References

https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2996 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 Exploit,Technical Description,Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2996 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Agile Plm by Oracle

Application Testing Suite by Oracle

Autovue For Agile Product Lifecycle Management by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Platform by Oracle

Banking Treasury Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Banking Virtual Account Management by Oracle

Blockchain Platform by Oracle

Cloud Backup by Netapp

Commerce Platform by Oracle

Commerce Platform by Oracle

Communications Billing And Revenue Management by Oracle

Communications Billing And Revenue Management by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Convergent Charging Controller by Oracle

Communications Diameter Signaling Router by Oracle

Communications Evolved Communications Application Server by Oracle

Communications Instant Messaging Server by Oracle

Communications Interactive Session Recorder by Oracle

Communications Interactive Session Recorder by Oracle

Communications Messaging Server by Oracle

Communications Messaging Server by Oracle

Communications Network Charging And Control by Oracle

Communications Offline Mediation Controller by Oracle

Communications Pricing Design Center by Oracle

Communications Services Gatekeeper by Oracle

Communications Session Route Manager by Oracle

Communications Unified Inventory Management by Oracle

Debian Linux by Debian

Documaker by Oracle

Documaker by Oracle

Goldengate Application Adapters by Oracle

Insurance Policy Administration by Oracle

Insurance Policy Administration by Oracle

Insurance Rules Palette by Oracle

Insurance Rules Palette by Oracle

Jackson Databind by Fasterxml

Jackson Databind by Fasterxml

Jd Edwards Enterpriseone Orchestrator by Oracle

Jd Edwards Enterpriseone Tools by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Gateway by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Primavera Unifier by Oracle

Retail Customer Management And Segmentation Foundation by Oracle

Retail Merchandising System by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Service Backbone by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Service Level Manager by Netapp

Webcenter Portal by Oracle

Webcenter Portal by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable default typing