Jackson-Databind Unwrapped Creator View Bypass

Executive Summary

The vulnerability exists in jackson-databind versions from 2.21.0 until 2.21.4 and 3.1.4. It involves the UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method, which replays buffered JSON into constructor parameters without checking the visibility of properties based on the active JSON view.

Normally, properties annotated with @JsonView are only populated if the active view allows it. However, this vulnerability allows an attacker to bypass that check when a constructor parameter is annotated with both @JsonView(AdminView.class) and @JsonUnwrapped, enabling attacker-controlled JSON to populate that parameter even when a more restrictive view is active.

This issue was fixed in versions 2.21.4 and 3.1.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to inject or manipulate data in constructor parameters that should be restricted by JSON view annotations. Specifically, attacker-controlled JSON can populate sensitive parameters even when access should be limited.

As a result, this could lead to unauthorized data exposure or manipulation, potentially compromising the integrity and confidentiality of the application data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade jackson-databind to version 2.21.4 or later, or 3.1.4 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to sensitive data by bypassing the @JsonView annotation, which is intended to restrict data exposure based on views. Because it enables attackers to populate constructor parameters annotated with restrictive views from untrusted JSON input, it can lead to unauthorized data exposure or modification.

Such unauthorized data exposure or manipulation can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on access to sensitive personal or health information.

By circumventing intended access controls, this vulnerability increases the risk of confidentiality and integrity breaches, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the Jackson Databind library's handling of @JsonView annotations for unwrapped creator parameters during JSON deserialization. Detection involves identifying if your system or application is using a vulnerable version of Jackson Databind.

To detect the vulnerability on your system, you should check the version of the jackson-databind library in use. Versions from 2.21.0 up to 2.21.3 inclusive, and from 3.0.0 up to 3.1.3 inclusive, are vulnerable. Versions 2.21.4 and 3.1.4 or later contain the fix.

• Use dependency management tools or commands to check the jackson-databind version, for example:
• For Maven projects: mvn dependency:list | grep jackson-databind
• For Gradle projects: ./gradlew dependencies --configuration runtimeClasspath | grep jackson-databind
• For systems with installed JARs, you can check the version by inspecting the JAR manifest or filename, e.g.:
• unzip -p jackson-databind-*.jar META-INF/MANIFEST.MF | grep 'Implementation-Version'

There are no specific network detection commands or signatures provided in the resources, as this vulnerability is a library-level issue affecting deserialization logic rather than a network-level exploit detectable by scanning traffic.

Useful 0 Not Useful 0