CVE-2020-36179: Netapp Cloud Backup RCE Vulnerability

CVE-2020-36179 Overview

CVE-2020-36179 is an insecure deserialization vulnerability in FasterXML jackson-databind 2.x versions before 2.9.10.8. The vulnerability stems from improper handling of the interaction between serialization gadgets and polymorphic typing, specifically related to the oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS class. When polymorphic type handling is enabled, an attacker can craft malicious JSON input that leverages this gadget class to achieve remote code execution.

This vulnerability is part of a series of jackson-databind deserialization issues that have affected numerous enterprise applications. The widespread use of jackson-databind as a JSON processing library across Java applications makes this vulnerability particularly impactful, affecting products from Oracle, NetApp, Debian, and many other vendors.

Critical Impact

Remote code execution possible through malicious JSON deserialization when polymorphic typing is enabled, potentially compromising confidentiality, integrity, and availability of affected systems.

Affected Products

• FasterXML jackson-databind 2.x before 2.9.10.8
• NetApp Cloud Backup
• NetApp Service Level Manager
• Debian Linux 9.0
• Oracle Agile PLM 9.3.6
• Oracle Application Testing Suite 13.3.0.1
• Oracle Banking Corporate Lending Process Management (14.2, 14.3, 14.5)
• Oracle Communications Billing and Revenue Management
• Oracle Data Integrator 12.2.1.4.0
• Oracle Primavera Gateway
• Oracle Retail XStore Point of Service
• Oracle WebCenter Portal

Discovery Timeline

• 2021-01-07 - CVE-2020-36179 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-36179

Vulnerability Analysis

This insecure deserialization vulnerability occurs when jackson-databind processes JSON data with polymorphic type handling enabled (such as when using @JsonTypeInfo with Id.CLASS or Id.MINIMAL_CLASS, or when default typing is enabled). The DriverAdapterCPDS class from Apache Commons DBCP serves as a gadget that can be exploited during the deserialization process.

When the vulnerable configuration is present, an attacker can submit specially crafted JSON containing type information that causes jackson-databind to instantiate the DriverAdapterCPDS class. This class has properties that, when set through deserialization, can trigger malicious behavior including JNDI lookups that lead to remote code execution.

The attack is network-accessible and requires no authentication or user interaction, though the attack complexity is considered high because the target application must have polymorphic typing enabled and the vulnerable gadget class must be present in the application's classpath.

Root Cause

The root cause lies in jackson-databind's insufficient blocklist of classes that can be instantiated during polymorphic deserialization. When an application enables polymorphic type handling, jackson-databind allows the incoming JSON to specify which Java class should be instantiated to represent the data. While jackson-databind maintains a blocklist of known dangerous classes, the oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS class was not included in versions prior to 2.9.10.8.

This class becomes dangerous because it implements setter methods that can trigger JNDI lookups or other unsafe operations when properties are set during deserialization. The combination of polymorphic typing and an unblocklisted gadget class creates an exploitable condition.

Attack Vector

The attack vector for CVE-2020-36179 involves network-based exploitation targeting Java applications that use vulnerable versions of jackson-databind with polymorphic typing enabled.

An attacker sends a malicious JSON payload to an endpoint that deserializes JSON data using the vulnerable library. The payload contains type information instructing jackson-databind to instantiate the DriverAdapterCPDS gadget class with attacker-controlled property values. These property values can include JNDI URLs pointing to attacker-controlled servers.

When deserialized, the gadget class's setter methods are invoked, potentially triggering a JNDI lookup to a malicious LDAP or RMI server. This server can then return serialized Java objects that, when deserialized by the victim application, execute arbitrary code.

The exploitation mechanism involves crafting a JSON payload that specifies the gadget class type and includes malicious property values. The specific exploitation details can be found in the GitHub Issue #3004 which documents this vulnerability.

Detection Methods for CVE-2020-36179

Indicators of Compromise

• Unusual outbound connections to external LDAP or RMI servers from Java application processes
• JSON requests containing suspicious type information such as @class, @type, or similar polymorphic type indicators with DBCP-related class names
• Unexpected DriverAdapterCPDS class instantiation in application logs
• JNDI lookup exceptions or errors in application logs referencing external URLs

Detection Strategies

• Monitor for JSON payloads containing the string oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS in web application firewall (WAF) logs
• Implement network monitoring for outbound connections on LDAP (port 389, 636) and RMI (port 1099) protocols from application servers
• Scan application dependencies using software composition analysis (SCA) tools to identify vulnerable jackson-databind versions
• Review application code for usage of @JsonTypeInfo annotations or ObjectMapper.enableDefaultTyping() calls

Monitoring Recommendations

• Deploy application-level logging to capture all JSON deserialization events with type information
• Configure SIEM rules to alert on patterns matching jackson-databind gadget chain exploitation attempts
• Establish baseline network behavior for application servers and alert on anomalous outbound JNDI-related traffic
• Implement regular dependency scanning as part of CI/CD pipelines to detect vulnerable library versions before deployment

How to Mitigate CVE-2020-36179

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.8 or later immediately for all affected applications
• If immediate upgrade is not possible, disable polymorphic type handling in jackson-databind configurations
• Audit all applications using jackson-databind to identify those with polymorphic typing enabled
• Remove Apache Commons DBCP from the classpath if it is not required by the application

Patch Information

The vulnerability is fixed in jackson-databind version 2.9.10.8 and later versions. The fix adds the DriverAdapterCPDS gadget class to jackson-databind's blocklist, preventing its instantiation during polymorphic deserialization.

Organizations should upgrade to the latest stable version of jackson-databind, which at minimum should be version 2.9.10.8 for the 2.9.x branch. For newer applications, consider upgrading to the 2.12.x or later branch which includes additional security improvements.

Detailed patch information and security advisories are available from multiple vendors:

• FasterXML GitHub Issue #3004
• Oracle Security Alert April 2021
• Debian LTS Announcement
• NetApp Security Advisory

For additional context on jackson-databind CVEs and proper risk assessment, see the Medium Blog Post on Jackson CVEs by the jackson-databind maintainer.

Workarounds

• Disable default typing globally by not calling ObjectMapper.enableDefaultTyping() or ObjectMapper.activateDefaultTyping()
• If polymorphic typing is required, use @JsonTypeInfo with Id.NAME instead of Id.CLASS or Id.MINIMAL_CLASS, combined with explicit type registration
• Implement a custom PolymorphicTypeValidator to restrict which classes can be deserialized
• Use network segmentation to prevent application servers from making outbound LDAP/RMI connections

# Maven dependency upgrade example
# Update pom.xml to use patched version:
# <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-databind</artifactId>
#     <version>2.9.10.8</version>
# </dependency>

# Verify installed version with Maven:
mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind

# For Gradle projects, check dependencies:
gradle dependencies --configuration compileClasspath | grep jackson-databind