CVE-2020-24616

CVE-2020-24616: Jackson Databind Unsafe Deserialization via Anteros-DBCP

CVE-2020-24616 is a remote code execution (RCE) vulnerability in FasterXML jackson-databind versions 2.x before 2.9.10.6. The issue arises from the library's handling of polymorphic type deserialization when enableDefaultTyping() is used. The vulnerability is related to the interaction between serialization gadgets and typing, specifically involving the br.com.anteros.dbcp.AnterosDBCPDataSource class from the Anteros-DBCP library [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious JSON payload that, when deserialized by a Jackson object mapper with default typing enabled, triggers the instantiation of an AnterosDBCPDataSource object. This object's constructor or setter methods can be leveraged to execute arbitrary commands, similar to other known Jackson gadget chains. The attack requires no authentication if the endpoint is exposed, but relies on the presence of the Anteros-DBCP library on the classpath [3].

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the server, leading to full system compromise. The vulnerability was assigned a CVSS score of 8.1 (High) due to the potential for RCE without user interaction [2].

Mitigation

The fix was implemented in jackson-databind version 2.9.10.6 by adding br.com.anteros.dbcp.AnterosDBCPDataSource to the block list in SubTypeValidator [4]. Users should upgrade to this version or later, or disable default typing if possible. No workaround exists other than upgrading or removing the vulnerable class from the classpath.