CVE-2020-9548: Jackson-databind Deserialization Vulnerability

CVE-2020-9548 Overview

CVE-2020-9548 is a critical insecure deserialization vulnerability in FasterXML jackson-databind versions 2.x before 2.9.10.4. The vulnerability stems from improper handling of the interaction between serialization gadgets and polymorphic typing, specifically related to the br.com.anteros.dbcp.AnterosDBCPConfig class (part of anteros-core). When polymorphic type handling is enabled, attackers can craft malicious JSON payloads that exploit this gadget class to achieve remote code execution on vulnerable systems.

Critical Impact

Remote attackers can execute arbitrary code on systems using vulnerable jackson-databind versions with polymorphic type handling enabled, potentially leading to complete system compromise.

Affected Products

• FasterXML jackson-databind 2.x before 2.9.10.4
• NetApp Active IQ Unified Manager (Linux, Windows, VMware vSphere)
• Debian Linux 8.0
• Oracle Agile PLM 9.3.6
• Oracle WebLogic Server 12.2.1.3.0 and 12.2.1.4.0
• Oracle Banking Digital Experience (versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1)
• Oracle Communications products (Calendar Server, Contacts Server, Diameter Signaling Router, Element Manager, Instant Messaging Server)
• Oracle Enterprise Manager Base Platform
• Oracle Primavera Unifier
• Oracle Retail XStore Point of Service (versions 15.0, 16.0, 17.0, 18.0, 19.0)

Discovery Timeline

• March 2, 2020 - CVE-2020-9548 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-9548

Vulnerability Analysis

This vulnerability belongs to a class of insecure deserialization issues that have affected jackson-databind over multiple releases. The core problem lies in how jackson-databind handles polymorphic type deserialization when default typing is enabled. The AnterosDBCPConfig class from the anteros-core library serves as a "gadget" that can be abused during deserialization.

When an application uses jackson-databind with polymorphic type handling (via enableDefaultTyping() or similar configurations), it allows incoming JSON to specify which class should be instantiated. Attackers exploit this by crafting JSON payloads that reference dangerous classes like AnterosDBCPConfig, which during instantiation can trigger arbitrary code execution through its constructor or setter methods.

The vulnerability is particularly dangerous because jackson-databind is widely used across enterprise Java applications, and many of these applications process untrusted JSON input. The attack requires no authentication and can be executed remotely over the network.

Root Cause

The root cause is CWE-502: Deserialization of Untrusted Data. Jackson-databind's polymorphic type handling feature allows type information to be embedded in JSON, enabling the deserializer to instantiate arbitrary classes. The library maintains a blocklist of known dangerous "gadget" classes, but br.com.anteros.dbcp.AnterosDBCPConfig was not included in this blocklist prior to version 2.9.10.4.

When the anteros-core library is present in the application's classpath, attackers can leverage this class as a deserialization gadget. The class contains properties or methods that, when invoked during deserialization, can be chained to achieve code execution.

Attack Vector

The attack vector is network-based, requiring the attacker to send a specially crafted JSON payload to an application endpoint that deserializes JSON using a vulnerable jackson-databind configuration. The attack does not require authentication or user interaction.

The exploitation flow involves:

1. Identifying an application using vulnerable jackson-databind with polymorphic typing enabled
2. Crafting a malicious JSON payload that includes the @type property pointing to br.com.anteros.dbcp.AnterosDBCPConfig
3. Including nested properties that trigger dangerous operations during deserialization
4. Sending the payload to a JSON-accepting endpoint

The vulnerability is exploitable when the anteros-core library is present in the application's classpath. Successful exploitation allows arbitrary code execution with the privileges of the application.

Detection Methods for CVE-2020-9548

Indicators of Compromise

• JSON payloads containing @type or @class properties referencing br.com.anteros.dbcp.AnterosDBCPConfig
• Unexpected process spawning from Java application processes
• Anomalous outbound network connections from application servers
• Log entries showing deserialization errors related to AnterosDBCPConfig class

Detection Strategies

• Implement application-layer logging to capture incoming JSON payloads containing polymorphic type indicators (@type, @class)
• Deploy web application firewall (WAF) rules to detect and block JSON payloads containing known gadget class names
• Monitor Java application logs for InvalidTypeIdException or other deserialization-related errors
• Use software composition analysis (SCA) tools to identify vulnerable jackson-databind versions in your codebase

Monitoring Recommendations

• Enable verbose logging for JSON deserialization activities in production environments
• Configure alerting for unexpected class loading attempts related to database connection pool classes
• Monitor network traffic for unusual patterns from Java application servers that may indicate successful exploitation
• Implement real-time scanning of incoming JSON requests for suspicious type declarations

How to Mitigate CVE-2020-9548

Immediate Actions Required

• Upgrade jackson-databind to version 2.9.10.4 or later immediately
• Disable default typing if not explicitly required: avoid using ObjectMapper.enableDefaultTyping()
• If polymorphic typing is necessary, use @JsonTypeInfo annotations with explicit type handling instead of global default typing
• Audit your application's classpath and remove anteros-core if not required

Patch Information

FasterXML has addressed this vulnerability in jackson-databind version 2.9.10.4 by adding br.com.anteros.dbcp.AnterosDBCPConfig to the blocklist of gadget classes. The fix is tracked in GitHub Issue #2634. Organizations using downstream products from Oracle, NetApp, or Debian should apply the appropriate vendor security patches as documented in the Oracle CPU January 2021, Oracle CPU October 2020, and Oracle CPU October 2021 advisories.

Workarounds

• Configure ObjectMapper to use PolymorphicTypeValidator to restrict which classes can be deserialized
• Implement input validation to reject JSON payloads containing @type or @class properties with suspicious class names
• Use a security manager or Java agent to prevent loading of known gadget classes
• Consider using jackson-databind's activateDefaultTyping() with LaissezFaireSubTypeValidator restrictions

# Maven dependency update to patch jackson-databind
# Update pom.xml to use patched version
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.9.10.4

# Verify updated dependency
mvn dependency:tree | grep jackson-databind

# For Gradle projects, update build.gradle
# implementation 'com.fasterxml.jackson.core:jackson-databind:2.9.10.4'