CVE-2020-35491: Jackson-databind RCE Vulnerability

CVE-2020-35491 Overview

CVE-2020-35491 is an insecure deserialization vulnerability affecting FasterXML jackson-databind 2.x before version 2.9.10.8. The vulnerability arises from improper handling of the interaction between serialization gadgets and typing, specifically related to the org.apache.commons.dbcp2.datasources.SharedPoolDataSource class. When polymorphic type handling is enabled, attackers can craft malicious JSON input that exploits this gadget class to achieve remote code execution.

Critical Impact

Successful exploitation allows remote attackers to execute arbitrary code on vulnerable systems through crafted JSON payloads, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• FasterXML jackson-databind (versions 2.x before 2.9.10.8)
• NetApp Service Level Manager
• Debian Linux 9.0
• Oracle Agile PLM 9.3.6
• Oracle Application Testing Suite 13.3.0.1
• Oracle Banking Platform (versions 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0)
• Oracle Communications Cloud Native Core Policy 1.14.0
• Oracle Communications Diameter Signaling Route
• Oracle Retail XStore Point of Service (multiple versions)
• Oracle WebCenter Portal (12.2.1.3.0, 12.2.1.4.0)

Discovery Timeline

• 2020-12-17 - CVE-2020-35491 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35491

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The jackson-databind library is a popular Java JSON serialization/deserialization framework used extensively in enterprise applications. When configured with polymorphic type handling (such as enableDefaultTyping() or @JsonTypeInfo annotations), the library allows JSON input to specify the Java class to instantiate during deserialization.

The vulnerability exploits the org.apache.commons.dbcp2.datasources.SharedPoolDataSource class as a "gadget" in the deserialization chain. This class, part of Apache Commons DBCP2 (Database Connection Pooling), contains setter methods that can be manipulated through deserialized properties to trigger dangerous operations, including JNDI lookups that can lead to remote code execution.

The attack requires network access and the application must be processing untrusted JSON input with polymorphic deserialization enabled. While exploitation complexity is higher due to the need for specific configuration and classpath requirements, successful attacks result in complete compromise of confidentiality, integrity, and availability.

Root Cause

The root cause lies in jackson-databind's insufficient blocklist for dangerous gadget classes when polymorphic type handling is enabled. The library maintains a list of known dangerous classes to prevent deserialization attacks, but the org.apache.commons.dbcp2.datasources.SharedPoolDataSource class was not included in versions prior to 2.9.10.8. This oversight allows attackers to specify this class in the @class or @type JSON property, causing the library to instantiate it with attacker-controlled properties.

Attack Vector

The attack is network-based and targets applications that:

1. Use a vulnerable version of jackson-databind
2. Have polymorphic type handling enabled (via enableDefaultTyping() or annotations)
3. Have Apache Commons DBCP2 on the classpath
4. Process untrusted JSON input

An attacker crafts a malicious JSON payload that specifies org.apache.commons.dbcp2.datasources.SharedPoolDataSource as the type to deserialize, along with properties that configure a malicious JNDI lookup URL. When the application deserializes this payload, it instantiates the gadget class and triggers a JNDI lookup to an attacker-controlled server, which can deliver a malicious Java object for code execution.

The exploitation mechanism involves crafting JSON with a type indicator pointing to the vulnerable gadget class, combined with properties that trigger JNDI resolution to an attacker-controlled endpoint. For detailed technical analysis, see the GitHub Issue #2986 - Jackson Databind and the Medium Blog on Jackson CVEs.

Detection Methods for CVE-2020-35491

Indicators of Compromise

• Unexpected outbound JNDI/LDAP connections to external servers from Java applications
• JSON payloads containing org.apache.commons.dbcp2.datasources.SharedPoolDataSource class references
• Unusual process spawning from Java application processes
• Network connections to unfamiliar LDAP or RMI endpoints on non-standard ports

Detection Strategies

• Monitor application logs for deserialization exceptions referencing blocklisted classes or SharedPoolDataSource
• Implement Web Application Firewall (WAF) rules to detect JSON payloads containing suspicious class names
• Use runtime application self-protection (RASP) solutions to detect and block deserialization attacks
• Deploy SentinelOne Singularity to monitor for post-exploitation behaviors such as command execution from Java processes

Monitoring Recommendations

• Enable verbose logging for jackson-databind deserialization operations in production environments
• Implement network monitoring for outbound LDAP, RMI, and JNDI traffic from application servers
• Set up alerts for any JSON processing errors that mention gadget classes or type handling issues
• Regularly scan application dependencies for vulnerable jackson-databind versions using software composition analysis tools

How to Mitigate CVE-2020-35491

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.8 or later immediately
• If immediate patching is not possible, disable polymorphic type handling by removing enableDefaultTyping() calls and @JsonTypeInfo annotations where not strictly necessary
• Remove Apache Commons DBCP2 from the classpath if not required by the application
• Implement input validation to reject JSON payloads containing unexpected type information

Patch Information

FasterXML has addressed this vulnerability in jackson-databind version 2.9.10.8 by adding org.apache.commons.dbcp2.datasources.SharedPoolDataSource to the blocklist of classes that cannot be deserialized when polymorphic type handling is enabled. Organizations should upgrade to this version or the latest available release. For Oracle products, refer to the applicable Critical Patch Updates: Oracle Security Alert CPU April 2021, Oracle Security Alert CPU July 2021, and Oracle Security Alert CPU January 2022.

Workarounds

• Use ObjectMapper.activateDefaultTyping() with a custom PolymorphicTypeValidator that explicitly allows only trusted classes
• Implement a custom StdSubtypeResolver to restrict polymorphic deserialization to known safe types
• Deploy network-level controls to block outbound LDAP and RMI connections from application servers
• Consider using jackson-databind's ObjectMapper.setDefaultTyping(null) to completely disable polymorphic type handling

# Check for vulnerable jackson-databind versions in Maven projects
mvn dependency:tree | grep "jackson-databind"

# Update jackson-databind in pom.xml to patched version
# <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-databind</artifactId>
#     <version>2.9.10.8</version>
# </dependency>

# For Gradle projects, check dependencies
./gradlew dependencies | grep jackson-databind