Executive Summary

The vulnerability exists in jackson-databind's JDKFromStringDeserializer, which constructs InetSocketAddress objects by performing eager DNS resolution during JSON deserialization. Specifically, from versions 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, the deserializer uses new InetSocketAddress(host, port), causing DNS queries to be issued immediately when deserializing untrusted JSON containing InetSocketAddress fields.

This means that if an application deserializes JSON data from an untrusted source into a type containing an InetSocketAddress, an attacker can trigger DNS queries of their choosing during the deserialization process, before any application-level validation or connection logic occurs.

The vulnerability is fixed by changing the code to use InetSocketAddress.createUnresolved(host, port), which defers DNS resolution until an explicit connection attempt is made.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause your application to perform arbitrary DNS lookups during JSON deserialization. This can lead to information leakage about your internal network or environment, as DNS queries may reveal details to an attacker-controlled DNS server.

Additionally, it may be used as a vector for DNS rebinding attacks or to trigger unwanted network activity, potentially leading to denial of service or other indirect impacts.

The CVSS base score of 5.3 indicates a medium severity impact, with low complexity and no required privileges or user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update jackson-databind to one of the fixed versions: 2.18.8, 2.21.4, or 3.1.4.

This update changes the deserialization behavior to use InetSocketAddress.createUnresolved(host, port), which defers DNS resolution and prevents attacker-chosen DNS queries during deserialization.

Useful 0 Not Useful 0