CVE-2020-9546: Jackson-databind Deserialization Vulnerability

CVE-2020-9546 Overview

CVE-2020-9546 is a critical insecure deserialization vulnerability in FasterXML jackson-databind 2.x before version 2.9.10.4. The vulnerability arises from improper handling of the interaction between serialization gadgets and typing, specifically related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (also known as shaded hikari-config). This flaw allows remote attackers to exploit polymorphic type handling to execute arbitrary code on vulnerable systems.

Critical Impact

Remote attackers can achieve arbitrary code execution through malicious JSON payloads when polymorphic type handling is enabled with Default Typing, potentially leading to complete system compromise.

Affected Products

• FasterXML jackson-databind 2.x before 2.9.10.4
• NetApp Active IQ Unified Manager (Linux, Windows, VMware vSphere)
• Debian Linux 8.0
• Oracle WebLogic Server 12.2.1.3.0 and 12.2.1.4.0
• Oracle Communications products (Calendar Server, Contacts Server, Diameter Signaling Router, Element Manager, Instant Messaging Server)
• Oracle Banking Digital Experience (versions 18.1 through 20.1)
• Oracle Financial Services products
• Oracle Primavera Unifier
• Oracle Retail products (Merchandising System, Sales Audit, Service Backbone, XStore Point of Service)

Discovery Timeline

• 2020-03-02 - CVE-2020-9546 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-9546

Vulnerability Analysis

This vulnerability belongs to a class of jackson-databind deserialization issues that have been recurring since 2017. The core problem lies in how jackson-databind handles polymorphic type deserialization when Default Typing is enabled. The library's ObjectMapper can be configured to include type information in serialized JSON, allowing it to deserialize objects back to their original types. However, this feature creates an attack surface when an attacker can supply malicious type information pointing to dangerous "gadget" classes.

In this specific case, the gadget class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig from the shaded HikariCP connection pool library can be leveraged for remote code execution. When the vulnerable jackson-databind version attempts to deserialize a crafted JSON payload containing this class, the deserialization process can trigger arbitrary code execution through the gadget chain.

Root Cause

The root cause is insufficient validation of class names during polymorphic deserialization. When Default Typing is enabled, jackson-databind trusts the type information provided in the JSON payload without adequately validating whether the specified class should be allowed for deserialization. The HikariConfig gadget class was not included in jackson-databind's blocklist, allowing attackers to specify this class in malicious JSON payloads and trigger code execution during deserialization.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker must identify an application endpoint that:

1. Uses a vulnerable version of jackson-databind (2.x before 2.9.10.4)
2. Has Default Typing enabled or uses @JsonTypeInfo with unsafe settings
3. Accepts JSON input that gets deserialized

The attacker crafts a malicious JSON payload containing type information that references the org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig class. When the application deserializes this payload, the gadget chain is triggered, allowing arbitrary code execution on the server. The attack requires no user interaction and can be fully automated, making it particularly dangerous for internet-facing applications.

For technical details on the vulnerability mechanism, refer to the GitHub Issue #2631 and the Medium blog post on Jackson CVEs.

Detection Methods for CVE-2020-9546

Indicators of Compromise

• Unusual JSON payloads in application logs containing @class or @type fields with references to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig
• Unexpected outbound network connections from application servers following JSON parsing operations
• Application crashes or errors related to class instantiation during deserialization
• Evidence of JNDI lookup attempts or suspicious class loading activity

Detection Strategies

• Implement application-layer monitoring to detect JSON payloads containing polymorphic type indicators (@class, @type) with suspicious class references
• Deploy Web Application Firewall (WAF) rules to block requests containing known jackson-databind gadget class names
• Use Software Composition Analysis (SCA) tools to identify applications using vulnerable jackson-databind versions
• Monitor Java process behavior for anomalous class loading or JNDI lookup patterns

Monitoring Recommendations

• Enable verbose logging for jackson-databind deserialization operations in development and staging environments
• Implement runtime application self-protection (RASP) to detect and block deserialization attacks
• Set up alerts for any attempts to instantiate classes from the com.zaxxer.hikari package during deserialization
• Regularly scan application dependencies using tools like OWASP Dependency-Check to identify vulnerable library versions

How to Mitigate CVE-2020-9546

Immediate Actions Required

• Upgrade FasterXML jackson-databind to version 2.9.10.4 or later immediately
• Audit all applications for Default Typing usage and disable it where not strictly necessary
• If Default Typing is required, implement explicit type validation using PolymorphicTypeValidator
• Review and restrict network access for applications processing untrusted JSON input

Patch Information

The vulnerability is addressed in jackson-databind version 2.9.10.4 and later. The fix adds org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig to the blocklist of classes that cannot be deserialized through polymorphic type handling. Organizations should update their dependencies to the patched version.

For Maven-based projects, update the dependency version in pom.xml. For Gradle projects, update the version in build.gradle. Verify the update using dependency tree analysis to ensure no transitive dependencies are pulling in older vulnerable versions.

Refer to vendor advisories for downstream product patches:

• Oracle Security Alert January 2021
• Oracle Security Alert October 2020
• NetApp Security Advisory
• Debian LTS Announcement

Workarounds

• Disable Default Typing entirely if not required for application functionality
• If polymorphic deserialization is needed, use explicit @JsonTypeInfo annotations with Id.NAME instead of Id.CLASS or Id.MINIMAL_CLASS
• Implement a custom PolymorphicTypeValidator to whitelist only expected classes for deserialization
• Deploy network-level controls to restrict untrusted input sources from reaching vulnerable endpoints

# Maven dependency update example
# In pom.xml, update jackson-databind version:
# <dependency>
#     <groupId>com.fasterxml.jackson.core</groupId>
#     <artifactId>jackson-databind</artifactId>
#     <version>2.9.10.4</version>
# </dependency>

# Verify installed version
mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind

# For Gradle projects
./gradlew dependencies --configuration compileClasspath | grep jackson-databind