{"id":9115,"date":"2019-08-07T03:26:14","date_gmt":"2019-08-07T03:26:14","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9115"},"modified":"2026-04-17T18:07:52","modified_gmt":"2026-04-17T18:07:52","slug":"jackson-databind-remote-code-execution-vulnerability-technical-analysis","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/jackson-databind-remote-code-execution-vulnerability-technical-analysis\/","title":{"rendered":"Jackson-databind Remote Code Execution Vulnerability Technical Analysis"},"content":{"rendered":"


\n<\/p>\n

    \n
  1. \n

    <\/a> Vulnerability Overview<\/strong><\/h2>\n<\/li>\n<\/ol>\n

    On June 21, Red Hat officially released a security bulletin to announce the fix for a vulnerability in jackson-dababind. This vulnerability with a CVSS score of 8.1 affects multiple Red Hat products and a sophisticated exploit using this vulnerability is observed in the wild. On July 22, a security researcher named Andrea Brancaleoni published an article to analyze this vulnerability.<\/p>\n

    This vulnerability is caused by Jackson’s incomplete blacklist. An application that uses jackson-databind will become vulnerable when the enableDefaultTyping method is called via the ObjectMapper object within the application. An attacker can thus compromise the application by sending maliciously crafted JSON input to gain direct control over a server.<\/p>\n

    Currently, a proof of concept (POC) exploit for this vulnerability has been publicly available. All users who are affected by this vulnerability should upgrade to the latest versions as soon as possible to fix this issue. The following is a successful exploitation of this vulnerability.<\/p>\n

    \"Red<\/a><\/p>\n

    Reference:<\/p>\n

    https:\/\/blog.doyensec.com\/2019\/07\/22\/jackson-gadgets.html<\/p>\n

    2.Scope of Impact<\/strong><\/h2>\n

    Affected Versions<\/strong><\/p>\n