Serialization Flaw in FasterXML Jackson Databind Affects Anteros-DBCP Product
CVE-2020-24616

8.1HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
25 August 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-24616?

A serialization vulnerability in FasterXML's jackson-databind library affects versions prior to 2.9.10.6, allowing potential exploitation through the interaction with serialization gadgets. The issue specifically relates to the br.com.anteros.dbcp.AnterosDBCPDataSource component, which can be manipulated to conduct unauthorized actions. This flaw emphasizes the necessity for developers using this library to update to secure versions to mitigate risks associated with serialization mishandling.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2020-24616-poc
Created by 0xkami

References

https://medium.com/%40cowtowncoder/on-jackson-cves-dont-p...
x_refsource_MISC
https://github.com/FasterXML/jackson-databind/issues/2814
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20200904-0006/
x_refsource_CONFIRM

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.