Serialization Flaw in FasterXML jackson-databind Affects Oracle JndiRealmFactory
CVE-2020-14195

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
16 June 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-14195?

The vulnerability in FasterXML's jackson-databind library occurs prior to version 2.9.10.5, where improper handling of serialization gadgets in conjunction with typing allows for potential exploitation. This affects the functionality of the JndiRealmFactory component within Oracle systems. Attackers could leverage these serialization issues to manipulate the behavior of applications relying on this library, leading to possible unauthorized access or app compromise.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-14195
Created by Al1ex

References

https://github.com/FasterXML/jackson-databind/issues/2765
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2020/07/msg0...
mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.