CVE-2020-10650: Debian Linux RCE Vulnerability

CVE-2020-10650 Overview

A deserialization flaw was discovered in jackson-databind through version 2.9.10.4. This vulnerability allows an unauthenticated user to perform remote code execution via malicious gadget classes in ignite-jta or quartz-core libraries. The affected classes include org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Critical Impact

Unauthenticated remote code execution through insecure deserialization allows attackers to fully compromise affected systems without requiring any user interaction or authentication credentials.

Affected Products

• FasterXML jackson-databind (through 2.9.10.4, including 2.10.0 pre-releases)
• Debian Linux 10.0
• NetApp Active IQ Unified Manager (Linux, VMware vSphere, Windows)
• Oracle Retail Merchandising System 15.0
• Oracle Retail Sales Audit 14.1

Discovery Timeline

• December 26, 2022 - CVE-2020-10650 published to NVD
• August 19, 2025 - Last updated in NVD database

Technical Details for CVE-2020-10650

Vulnerability Analysis

This insecure deserialization vulnerability exists in jackson-databind's polymorphic type handling mechanism. When applications use jackson-databind with default typing enabled or with @JsonTypeInfo annotations configured for polymorphic deserialization, attackers can craft malicious JSON payloads that instantiate dangerous "gadget" classes present on the application's classpath.

The vulnerability specifically targets JNDI lookup functionality within Apache Ignite JTA and Quartz Scheduler libraries. When these libraries are present on the classpath, an attacker can leverage the gadget classes to perform JNDI injection attacks, ultimately leading to remote code execution. The network-accessible nature of this vulnerability means that any application endpoint accepting JSON input could potentially be exploited, though successful exploitation requires the presence of specific gadget libraries and certain jackson-databind configurations.

Root Cause

The root cause is jackson-databind's insufficient blocklist of gadget classes that can be instantiated during deserialization. The library implements a blocklist-based approach to prevent dangerous class instantiation, but the specific classes org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider were not included in the blocklist prior to the patch.

These classes perform JNDI lookups as part of their initialization, allowing attackers to specify a malicious JNDI URL that points to an attacker-controlled server hosting a malicious Java object. When deserialized, these classes trigger the JNDI lookup, fetching and instantiating the remote malicious object, resulting in arbitrary code execution.

Attack Vector

The attack is network-based and can be executed by sending a specially crafted JSON payload to any application endpoint that processes JSON using a vulnerable jackson-databind configuration. The attacker embeds type information in the JSON that instructs jackson-databind to instantiate one of the vulnerable gadget classes with attacker-controlled parameters, including a malicious JNDI URL.

The exploitation flow involves: (1) sending a crafted JSON payload with polymorphic type hints, (2) jackson-databind deserializing the payload and instantiating the gadget class, (3) the gadget class performing a JNDI lookup to an attacker-controlled server, and (4) the JNDI response containing a malicious Java object that executes arbitrary code on the target system.

For detailed technical analysis of the vulnerability mechanism and the specific fix applied, see the GitHub Issue Discussion and the GitHub Commit Update.

Detection Methods for CVE-2020-10650

Indicators of Compromise

• Outbound JNDI/RMI/LDAP connections from application servers to unexpected external hosts
• Unusual JSON payloads in application logs containing class type identifiers like org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup or org.quartz.utils.JNDIConnectionProvider
• Unexpected process spawning from Java application processes
• Network traffic to known malicious JNDI servers or unusual ports (typically RMI registry on port 1099 or LDAP on 389/636)

Detection Strategies

• Implement application-layer monitoring to detect JSON payloads containing suspicious class type indicators or JNDI URL patterns
• Deploy network intrusion detection rules to identify outbound JNDI/RMI/LDAP traffic from application servers that should not make such connections
• Monitor for anomalous process execution chains originating from Java applications, particularly shell commands or script interpreters
• Use Software Composition Analysis (SCA) tools to identify applications using vulnerable jackson-databind versions

Monitoring Recommendations

• Enable verbose logging on jackson-databind deserialization operations to capture type handling events
• Implement egress filtering and alerting for outbound connections to non-approved JNDI/LDAP endpoints
• Deploy endpoint detection and response (EDR) solutions to monitor Java process behavior for exploitation indicators
• Regularly scan application dependencies to identify jackson-databind versions and potential gadget libraries on the classpath

How to Mitigate CVE-2020-10650

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.5 or later, or 2.10.1 or later for the 2.10.x branch
• Audit all Java applications for jackson-databind usage and default typing configurations
• Remove unused gadget libraries (ignite-jta, quartz-core) from application classpaths where possible
• If immediate patching is not possible, disable polymorphic type handling or implement strict type validation

Patch Information

FasterXML has released patches that add the vulnerable gadget classes to the deserialization blocklist. The fix is available in jackson-databind versions 2.9.10.5 and 2.10.1. Organizations should update their dependencies through their build management tools (Maven, Gradle, etc.) and redeploy affected applications.

For detailed patch information, refer to the GitHub Commit Update. Additional security guidance is available in the Oracle CPU January 2021 Alert and Oracle CPU October 2022 Alert.

Workarounds

• Disable default typing in jackson-databind by not using ObjectMapper.enableDefaultTyping() or equivalent configurations
• If polymorphic deserialization is required, use explicit type validators with ObjectMapper.setPolymorphicTypeValidator() to restrict allowed types
• Implement network egress controls to block outbound JNDI/RMI/LDAP connections from application servers
• Remove Apache Ignite JTA and Quartz Scheduler libraries from the classpath if they are not actively used by the application

# Configuration example: Update jackson-databind in Maven pom.xml
# Replace vulnerable version with patched version
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.9.10.5
# Or for 2.10.x branch
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.10.1