CVE-2020-24750: Jackson-databind RCE Vulnerability

CVE-2020-24750 Overview

CVE-2020-24750 is an insecure deserialization vulnerability affecting FasterXML jackson-databind versions 2.x before 2.9.10.6. The vulnerability arises from improper handling of the interaction between serialization gadgets and typing, specifically related to the com.pastdev.httpcomponents.configuration.JndiConfiguration class. When polymorphic type handling is enabled, attackers can craft malicious JSON payloads that exploit this gadget class to achieve remote code execution.

Critical Impact

This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of jackson-databind when processing untrusted JSON input with polymorphic type handling enabled.

Affected Products

• FasterXML jackson-databind versions 2.x before 2.9.10.6
• Oracle Agile PLM 9.3.6
• Oracle Application Testing Suite 13.3.0.1
• Oracle AutoVue for Agile Product Lifecycle Management 21.0.2
• Oracle Banking Corporate Lending Process Management 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Credit Facilities Process Management 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Liquidity Management 14.2, 14.3, 14.5
• Oracle Communications Calendar Server 8.0
• Oracle Communications Contacts Server 8.0
• Oracle Communications Diameter Signaling Router
• Oracle Communications Element Manager
• Oracle Communications Instant Messaging Server 10.0.1.5.0
• Oracle Blockchain Platform
• Debian Linux 9.0

Discovery Timeline

• September 17, 2020 - CVE-2020-24750 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-24750

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw exists in how jackson-databind handles polymorphic type deserialization when certain gadget classes are present on the classpath. The com.pastdev.httpcomponents.configuration.JndiConfiguration class can be abused as a deserialization gadget to perform JNDI injection attacks.

When an application uses jackson-databind with default typing enabled or explicit polymorphic type handling via @JsonTypeInfo, an attacker can supply a specially crafted JSON payload containing a reference to the vulnerable gadget class. During deserialization, the library instantiates the specified class and sets its properties, which can trigger a JNDI lookup to an attacker-controlled server, ultimately leading to remote code execution.

Root Cause

The root cause stems from jackson-databind's insufficient blocklist of dangerous gadget classes. When polymorphic deserialization is enabled (through enableDefaultTyping() or @JsonTypeInfo annotations), the library allows instantiation of arbitrary classes specified in the JSON input. The JndiConfiguration class from the pastdev httpcomponents library was not included in the gadget blocklist, allowing attackers to exploit it for JNDI injection attacks that can lead to remote code execution via malicious LDAP or RMI responses.

Attack Vector

The attack is network-based and requires no authentication or user interaction, though exploitation complexity is high as it requires specific conditions to be met. An attacker must:

1. Identify an application using a vulnerable jackson-databind version with polymorphic type handling enabled
2. Ensure the com.pastdev.httpcomponents.configuration.JndiConfiguration gadget class is present on the target application's classpath
3. Send a malicious JSON payload containing the gadget class type specification and JNDI URL pointing to an attacker-controlled server
4. Host a malicious LDAP/RMI server that returns a serialized Java object or class reference that executes arbitrary code when loaded

The attack leverages JNDI injection to force the target application to connect to an attacker-controlled naming service, which returns a malicious object that gets instantiated on the victim system.

Detection Methods for CVE-2020-24750

Indicators of Compromise

• Unexpected outbound JNDI connections (LDAP on port 1389 or RMI on port 1099) from Java application servers
• JSON payloads in application logs containing type identifiers referencing com.pastdev.httpcomponents.configuration.JndiConfiguration
• Network connections to unusual external LDAP or RMI servers from hosts running Java applications
• Application exceptions or stack traces mentioning JndiConfiguration class instantiation errors

Detection Strategies

• Implement network monitoring rules to detect outbound JNDI protocol connections (LDAP/RMI) from application servers to external destinations
• Configure Web Application Firewalls (WAF) to detect and block JSON payloads containing known jackson-databind gadget class names
• Enable verbose logging for jackson-databind deserialization operations to capture suspicious type resolution attempts
• Use Software Composition Analysis (SCA) tools to identify vulnerable jackson-databind versions in your software inventory

Monitoring Recommendations

• Monitor Java application logs for deserialization errors mentioning @type or @class JSON fields
• Implement egress filtering to block unauthorized LDAP and RMI connections from application servers
• Set up alerts for any DNS lookups or network connections to unknown external hosts from Java application processes
• Regularly scan application dependencies using tools like OWASP Dependency-Check to identify vulnerable library versions

How to Mitigate CVE-2020-24750

Immediate Actions Required

• Upgrade FasterXML jackson-databind to version 2.9.10.6 or later immediately
• If immediate upgrade is not possible, disable default typing by removing calls to ObjectMapper.enableDefaultTyping()
• Review application code for usage of @JsonTypeInfo annotations and restrict allowed subtypes using @JsonSubTypes
• Implement egress firewall rules to block outbound JNDI connections (LDAP/RMI) from application servers

Patch Information

FasterXML has released version 2.9.10.6 which adds com.pastdev.httpcomponents.configuration.JndiConfiguration to the gadget blocklist. The fix is available in the GitHub Commit. Additional details about the vulnerability are documented in the GitHub Issue Discussion.

Oracle has addressed this vulnerability in multiple Critical Patch Updates. Refer to the Oracle Security Alert April 2021, Oracle Security Alert October 2021, and subsequent advisories for patches to affected Oracle products.

Workarounds

• Disable polymorphic type handling completely if not required by removing enableDefaultTyping() calls and @JsonTypeInfo annotations
• Implement a custom TypeResolverBuilder that explicitly whitelists only trusted classes for deserialization
• Use ObjectMapper.setDefaultTyping() with PolymorphicTypeValidator to restrict allowed base types (available in jackson-databind 2.10+)
• Deploy network-level controls to block outbound JNDI connections from application servers as a defense-in-depth measure

// Secure ObjectMapper configuration example
ObjectMapper mapper = new ObjectMapper();
// Avoid using enableDefaultTyping() which enables dangerous polymorphic deserialization
// Instead, use explicit @JsonSubTypes for controlled polymorphism

// For jackson-databind 2.10+, use PolymorphicTypeValidator
PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
    .allowIfSubType("com.yourcompany.trusted.")
    .build();
mapper.activateDefaultTyping(ptv, ObjectMapper.DefaultTyping.NON_FINAL);