CVE-2020-36187: Jackson-databind Deserialization Flaw

CVE-2020-36187 Overview

CVE-2020-36187 is an insecure deserialization vulnerability in FasterXML jackson-databind 2.x before version 2.9.10.8. The vulnerability stems from improper handling of the interaction between serialization gadgets and typing, specifically related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. When polymorphic type handling is enabled, an attacker can craft malicious JSON payloads that leverage this gadget class to achieve remote code execution on vulnerable systems.

Critical Impact

This vulnerability allows remote attackers to execute arbitrary code on systems processing untrusted JSON input with polymorphic deserialization enabled, potentially leading to complete system compromise.

Affected Products

• FasterXML jackson-databind (versions prior to 2.9.10.8)
• NetApp Cloud Backup and Service Level Manager
• Debian Linux 9.0
• Oracle Agile PLM, Banking, Communications, and Retail product suites
• Multiple Oracle enterprise applications including WebCenter Portal and Data Integrator

Discovery Timeline

• 2021-01-06 - CVE-2020-36187 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-36187

Vulnerability Analysis

This vulnerability belongs to a class of deserialization attacks targeting Jackson's polymorphic type handling feature. Jackson-databind allows applications to deserialize JSON into Java objects, and when polymorphic type handling is enabled (via enableDefaultTyping() or @JsonTypeInfo annotations), the library can instantiate arbitrary classes specified in the JSON input.

The org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource class serves as a gadget chain entry point. When this class is deserialized, it can be manipulated to execute arbitrary code through its setter methods and initialization logic. This is part of a broader pattern of jackson-databind vulnerabilities where new gadget classes are discovered in common Java libraries that can be abused during deserialization.

The attack requires no authentication and can be executed remotely over the network. However, successful exploitation requires that the target application has polymorphic deserialization enabled and processes attacker-controlled JSON data.

Root Cause

The root cause is insufficient validation of class types during polymorphic deserialization. Jackson-databind maintains a blocklist of known dangerous classes to prevent deserialization attacks, but org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource was not included in this blocklist prior to version 2.9.10.8. This allows attackers to specify this class in JSON payloads, which Jackson will then instantiate and populate with attacker-controlled values.

Attack Vector

The attack vector is network-based, requiring the attacker to send crafted JSON payloads to an application endpoint that processes JSON using a vulnerable jackson-databind configuration. The attacker embeds a type indicator in the JSON that instructs Jackson to deserialize the data as a SharedPoolDataSource object. Through carefully crafted property values, the attacker can trigger code execution during object initialization or through subsequent method calls on the instantiated object.

The attack typically involves:

1. Identifying an application endpoint that accepts JSON input
2. Confirming the application uses jackson-databind with polymorphic typing enabled
3. Crafting a malicious JSON payload containing the gadget class reference
4. Sending the payload to trigger deserialization and code execution

For detailed technical analysis of this vulnerability class, see the Medium Article on Jackson CVEs and GitHub Jackson Issue #2997.

Detection Methods for CVE-2020-36187

Indicators of Compromise

• JSON payloads containing references to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource class
• Unusual JNDI lookups or outbound connections from Java application processes
• Unexpected process spawning from Java application servers
• Error logs showing deserialization exceptions for Tomcat DBCP classes in applications that don't normally use them

Detection Strategies

• Implement application-level logging to capture all incoming JSON payloads containing @class or @type fields
• Deploy network intrusion detection rules to identify JSON payloads referencing known gadget classes
• Monitor for unusual Java class loading activity, particularly classes from org.apache.tomcat.dbcp packages
• Use software composition analysis (SCA) tools to identify vulnerable jackson-databind versions in your application dependencies

Monitoring Recommendations

• Enable verbose logging on JSON parsing endpoints to capture deserialization attempts
• Configure SIEM rules to alert on patterns consistent with polymorphic deserialization attacks
• Monitor outbound network connections from application servers for unexpected JNDI or RMI traffic
• Implement runtime application self-protection (RASP) to detect and block deserialization gadget chains

How to Mitigate CVE-2020-36187

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.8 or later immediately
• Audit all applications for use of enableDefaultTyping() or @JsonTypeInfo with unsafe configurations
• Implement input validation to reject JSON containing unexpected type information
• Consider using ObjectMapper.setDefaultTyping() with a restricted type validator

Patch Information

FasterXML has released version 2.9.10.8 which adds org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource to the blocklist of classes that cannot be deserialized. Organizations should update their jackson-databind dependencies through their build management system (Maven, Gradle, etc.).

For Oracle products, refer to the Oracle Critical Patch Updates April 2021, Oracle Critical Patch Updates July 2021, Oracle Critical Patch Updates October 2021, Oracle Critical Patch Updates January 2022, and Oracle Critical Patch Updates April 2022 for product-specific patches.

For NetApp products, see the NetApp Security Advisory NTAP-20210205-0005.

For Debian systems, see the Debian LTS Announcement April 2021.

Workarounds

• Disable polymorphic type handling entirely if not required by your application
• Use PolymorphicTypeValidator to explicitly whitelist only the classes your application needs to deserialize
• Implement a custom deserializer that rejects type information in incoming JSON
• Deploy a web application firewall (WAF) rule to block JSON payloads containing references to known gadget classes

# Maven dependency update example
# Update pom.xml to use patched version:
# <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-databind</artifactId>
#     <version>2.9.10.8</version>
# </dependency>

# Verify current jackson-databind version in your project
mvn dependency:tree | grep jackson-databind