Deserialization Flaw in Jackson-Databind

Compliance Impact

This vulnerability allows unauthorized modification of data fields that were intended to be excluded from deserialization, potentially leading to improper handling of sensitive or protected data.

Such unauthorized data modifications could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data integrity and protection of sensitive information.

Because the vulnerability enables mass-assignment-style writes to ignored properties, it may allow attackers to bypass intended data restrictions, increasing the risk of data integrity violations.

However, the vulnerability primarily affects data integrity and does not impact confidentiality or availability directly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the jackson-databind library's deserialization process and specifically affects applications that use case-insensitive matching with @JsonIgnoreProperties annotations. Detection involves identifying if your application uses a vulnerable version of jackson-databind and if it enables case-insensitive deserialization with @JsonIgnoreProperties.

To detect the vulnerability on your system, first check the version of jackson-databind in use. Vulnerable versions include those from 2.8.0 up to but not including 2.18.9, 2.19.0 up to but not including 2.21.5, 2.22.0 up to but not including 2.22.1, and 3.1.0 up to but not including 3.1.4.

You can run commands to identify the jackson-databind version in your project or deployed environment. For example, in a Maven project, use:

• mvn dependency:list | grep jackson-databind

Or in a Gradle project, use:

• gradle dependencies | grep jackson-databind

If you have access to the deployed environment's JAR files, you can check the version by inspecting the manifest or filename of the jackson-databind JAR.

To detect exploitation attempts on your network, monitor for JSON input that attempts to set properties that should be ignored by @JsonIgnoreProperties, especially when case-insensitive matching is enabled. However, there are no specific network detection commands or signatures provided in the available resources.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the jackson-databind library versions from 2.8.0 up to 2.18.9, 2.21.5, and 3.1.4. It occurs in the BeanDeserializerBase.createContextual() method where per-property @JsonIgnoreProperties exclusions are applied to remove ignored properties from the BeanPropertyMap. However, a subsequent case-insensitivity processing step incorrectly rebuilds the property map from the original unfiltered properties instead of the filtered ones, effectively restoring the ignored properties and making them writable again.

This means that properties that were supposed to be ignored during deserialization can be manipulated, potentially allowing unintended data binding behavior.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unintended writable access to properties that were meant to be ignored during data deserialization. This can result in improper handling of data, potentially allowing attackers to inject or modify data fields that should have been excluded.

Such behavior can cause integrity issues in applications relying on jackson-databind for JSON processing, possibly leading to security risks such as data corruption or unauthorized data manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade jackson-databind to one of the fixed versions: 2.18.9, 2.21.5, or 3.1.4.

Useful 0 Not Useful 0