CVE-2020-35490: Jackson-databind RCE Vulnerability

CVE-2020-35490 Overview

FasterXML jackson-databind 2.x before 2.9.10.8 contains an insecure deserialization vulnerability that mishandles the interaction between serialization gadgets and typing. This vulnerability is specifically related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource, which can be leveraged as a gadget class to achieve remote code execution when polymorphic type handling is enabled.

Critical Impact

This vulnerability allows remote attackers to potentially execute arbitrary code on systems using vulnerable versions of jackson-databind when processing untrusted JSON input with polymorphic deserialization enabled.

Affected Products

• FasterXML jackson-databind (versions before 2.9.10.8)
• NetApp Service Level Manager
• Debian Linux 9.0
• Oracle Agile PLM 9.3.6
• Oracle Application Testing Suite 13.3.0.1
• Oracle Banking Platform (versions 2.6.2 through 2.10.0)
• Oracle Communications Cloud Native Core Policy 1.14.0
• Oracle Communications Diameter Signaling Router
• Oracle WebCenter Portal (versions 12.2.1.3.0 and 12.2.1.4.0)
• Multiple additional Oracle enterprise products

Discovery Timeline

• December 17, 2020 - CVE-2020-35490 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-35490

Vulnerability Analysis

This vulnerability belongs to a class of insecure deserialization flaws (CWE-502) that affect jackson-databind's polymorphic type handling feature. When applications use jackson-databind with default typing enabled or explicit @JsonTypeInfo annotations, the library can deserialize JSON into arbitrary Java objects based on type information embedded in the input data.

The vulnerability exploits the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource class from Apache Commons DBCP2 as a "gadget" class. When this class is deserialized, its setter methods can be abused to perform malicious operations, including establishing database connections to attacker-controlled servers or triggering JNDI lookups that lead to remote code execution.

The attack requires that the target application has both jackson-databind and Apache Commons DBCP2 on the classpath, and that polymorphic deserialization is enabled for untrusted input.

Root Cause

The root cause lies in jackson-databind's handling of polymorphic type information during deserialization. When the library encounters type metadata in JSON input, it attempts to instantiate the specified class and populate its properties. The PerUserPoolDataSource class was not included in jackson-databind's blocklist of dangerous gadget classes, allowing attackers to specify this class in malicious JSON payloads.

The blocklist approach used by jackson-databind requires continuous updates as new gadget classes are discovered, making it inherently reactive rather than proactive against deserialization attacks.

Attack Vector

The attack is network-based and targets applications that accept JSON input from untrusted sources. An attacker crafts a malicious JSON payload containing type information that references the org.apache.commons.dbcp2.datasources.PerUserPoolDataSource gadget class, along with properties configured to trigger malicious behavior during deserialization.

The exploitation scenario involves sending specially crafted JSON data to a vulnerable endpoint. When jackson-databind deserializes this payload, it instantiates the gadget class and invokes setters with attacker-controlled values, potentially leading to JNDI injection and ultimately remote code execution.

For technical details on the specific gadget chain and exploitation mechanics, see the GitHub Issue #2986 which tracks this vulnerability.

Detection Methods for CVE-2020-35490

Indicators of Compromise

• Unexpected network connections to external LDAP, RMI, or DNS servers from Java applications
• Presence of PerUserPoolDataSource class references in application logs or JSON input
• Unusual JNDI lookup attempts in application server logs
• Suspicious serialized Java objects in network traffic or log files

Detection Strategies

• Monitor application logs for deserialization errors or exceptions involving org.apache.commons.dbcp2 classes
• Implement network monitoring to detect outbound JNDI connections to unexpected destinations
• Use static analysis tools to identify jackson-databind usage with polymorphic type handling enabled
• Deploy runtime application security testing (RASP) to detect deserialization attacks

Monitoring Recommendations

• Enable verbose logging for jackson-databind to capture deserialization attempts
• Configure intrusion detection systems to alert on JSON payloads containing suspicious class names
• Monitor dependency versions in CI/CD pipelines to detect vulnerable jackson-databind versions
• Implement egress filtering to block unexpected outbound connections from application servers

How to Mitigate CVE-2020-35490

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.8 or later immediately
• Audit applications for use of polymorphic type handling with untrusted input
• Disable default typing if not strictly required for application functionality
• Review classpath dependencies and remove Apache Commons DBCP2 if not needed

Patch Information

FasterXML has released jackson-databind version 2.9.10.8 which adds org.apache.commons.dbcp2.datasources.PerUserPoolDataSource to the blocklist of dangerous gadget classes. Organizations should upgrade to this version or later to mitigate the vulnerability.

Multiple vendors have released security updates addressing this vulnerability:

• Oracle CPU April 2021 Security Alert
• Oracle CPU July 2021 Security Alert
• Oracle CPU October 2021 Security Alert
• NetApp Security Advisory NTAP-20210122-0005
• Debian LTS Announcement April 2021

Workarounds

• Disable polymorphic type handling by removing @JsonTypeInfo annotations and disabling ObjectMapper.enableDefaultTyping()
• Use ObjectMapper.activateDefaultTyping() with a custom PolymorphicTypeValidator to restrict allowed types
• Implement input validation to reject JSON containing @class or @type fields if polymorphic deserialization is not required
• Configure network egress rules to block JNDI connections to external servers

# Maven dependency update example
# Update pom.xml to use patched version:
# <dependency>
#   <groupId>com.fasterxml.jackson.core</groupId>
#   <artifactId>jackson-databind</artifactId>
#   <version>2.9.10.8</version>
# </dependency>

# Verify current jackson-databind version in your project
mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind