Serialization Gadget Vulnerability in FasterXML Jackson-databind by FasterXML
CVE-2020-36184

8.1HIGH

Key Information:

Vendor
Netapp
Status
Cloud Backup
Service Level Manager
Vendor
CVE Published:
6 January 2021

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability exists in FasterXML's jackson-databind library, specifically in versions prior to 2.9.10.8, where the interaction between serialization gadgets and data typing can be mishandled. This flaw is related to the org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource, potentially allowing attackers to exploit improper handling of serialized data. Users of affected versions should apply the recommended patches to mitigate any security risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36184
Created by Al1ex

References

https://cowtowncoder.medium.com/on-jackson-cves-dont-pani...
x_refsource_MISC
https://github.com/FasterXML/jackson-databind/issues/2998
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg0...
mailing-listx_refsource_MLIST

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-36184 : Serialization Gadget Vulnerability in FasterXML Jackson-databind by FasterXML | SecurityVulnerability.io