CVE-2020-35490

Vulnerability

Overview

CVE-2020-35490 is a vulnerability in FasterXML jackson-databind versions 2.x before 2.9.10.8. The issue arises from improper handling of the interaction between serialization gadgets and the default typing mechanism. Specifically, the PerUserPoolDataSource class from the Apache Commons DBCP2 library is not blocked by default, enabling exploitation when default typing is enabled [1][2]. The root cause is an incomplete deny list for dangerous gadget classes in the SubTypeValidator class [4].

Exploitation

Exploitation requires that Jackson's default typing is enabled and that an attacker can supply malicious serialized data to a vulnerable application. The attack does not require authentication if the application deserializes untrusted input over a network. The attacker crafts a JSON payload that triggers instantiation of the gadget class, leading to arbitrary code execution [2][3]. The commons-dbcp2 library must be present on the classpath for exploitation to succeed [3].

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution in the context of the application. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system [2]. The vulnerability is similar to other Jackson deserialization issues that leverage gadget chains in common Java libraries.

Mitigation

The vulnerability is fixed in jackson-databind version 2.9.10.8, released on December 2020, which adds PerUserPoolDataSource and SharedPoolDataSource to the list of blocked gadget types [4]. Users are advised to upgrade immediately. If upgrading is not possible, disabling default typing is an effective workaround, though it may impact application functionality [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of analysis.