Impact Analysis

This vulnerability can allow an attacker to inject or manipulate data in constructor parameters that should be restricted by JSON view annotations. Specifically, attacker-controlled JSON can populate sensitive parameters even when access should be limited.

As a result, this could lead to unauthorized data exposure or manipulation, potentially compromising the integrity and confidentiality of the application data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade jackson-databind to version 2.21.4 or later, or 3.1.4 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in jackson-databind versions from 2.21.0 until 2.21.4 and 3.1.4. It involves the UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method, which replays buffered JSON into constructor parameters without checking the visibility of properties based on the active JSON view.

Normally, properties annotated with @JsonView are only populated if the active view allows it. However, this vulnerability allows an attacker to bypass that check when a constructor parameter is annotated with both @JsonView(AdminView.class) and @JsonUnwrapped, enabling attacker-controlled JSON to populate that parameter even when a more restrictive view is active.

This issue was fixed in versions 2.21.4 and 3.1.4.

Useful 0 Not Useful 0