Polymorphic deserialization of malicious object in jackson-databind
High severity
GitHub Reviewed
Published
May 15, 2020
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.9.0, < 2.9.10
Patched versions
2.9.10
Description
Published by the National Vulnerability Database
Mar 2, 2020
Reviewed
Apr 22, 2020
Published to the GitHub Advisory Database
May 15, 2020
Last updated
Feb 1, 2023
A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as
enableDefaultTyping()or when @JsonTypeInfo is usingId.CLASSorId.MINIMAL_CLASSor in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.References