CVE-2017-7525 - Deserialization of Untrusted Data

Severity

75%

Complexity

99%

Confidentiality

106%

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 3.0 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Demo Examples

Deserialization of Untrusted Data

CWE-502

This code snippet deserializes an object from a file and uses it as a UI button:


               
}
in.close();

This code does not attempt to verify the source or contents of the file before deserializing it. An attacker may be able to replace the intended file with a file that contains arbitrary malicious code which will be executed when the button is pressed.

To mitigate this, explicitly define final readObject() to prevent deserialization. An example of this is:


               
throw new java.io.IOException("Cannot be deserialized"); }

Deserialization of Untrusted Data

CWE-502

In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [R.502.7], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token.


               
}
raise AuthFail

Unfortunately, the code does not verify that the incoming data is legitimate. An attacker can construct a illegitimate, serialized object "AuthToken" that instantiates one of Python's subprocesses to execute arbitrary commands. For instance,the attacker could construct a pickle that leverages Python's subprocess module, which spawns new processes and includes a number of arguments for various uses. Since Pickle allows objects to define the process for how they should be unpickled, the attacker can direct the unpickle process to call Popen in the subprocess module and execute /bin/sh.

Overview

First reported 7 years ago

2018-02-06 15:29:00

Last updated 5 years ago

2019-09-27 03:15:00

Affected Software

Debian Linux 8.0 (Jessie)

8.0

Debian Linux 9.0

9.0

FasterXML Jackson

Red Hat JBoss Enterprise Application Platform (EAP) 6.0.0

6.0.0

Red Hat JBoss Enterprise Application Platform (EAP) 6.4.0

6.4.0

Red Hat JBoss Enterprise Application Platform (EAP) 7.0.0

7.0.0

Red Hat JBoss Enterprise Application Platform (EAP) 7.1.0

7.1.0

Red Hat Virtualization Host 4.0

4.0

Red Hat Virtualization 4.0

4.0

References

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Patch, Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Patch, Third Party Advisory

99623

Third Party Advisory, VDB Entry

1039744

Third Party Advisory, VDB Entry

1039947

Third Party Advisory, VDB Entry

1040360

Third Party Advisory, VDB Entry

RHSA-2017:1834

Third Party Advisory

RHSA-2017:1835

Third Party Advisory

RHSA-2017:1836

Third Party Advisory

RHSA-2017:1837

Third Party Advisory

RHSA-2017:1839

Third Party Advisory

RHSA-2017:1840

Third Party Advisory

RHSA-2017:2477

Third Party Advisory

RHSA-2017:2546

Third Party Advisory

RHSA-2017:2547

Third Party Advisory

RHSA-2017:2633

Third Party Advisory

RHSA-2017:2635

Third Party Advisory

RHSA-2017:2636

Third Party Advisory

RHSA-2017:2637

Third Party Advisory

RHSA-2017:2638

Third Party Advisory

RHSA-2017:3141

Third Party Advisory

RHSA-2017:3454

Third Party Advisory

RHSA-2017:3455

Third Party Advisory

RHSA-2017:3456

Third Party Advisory

RHSA-2017:3458

Third Party Advisory

RHSA-2018:0294

Third Party Advisory

RHSA-2018:0342

Third Party Advisory

RHSA-2018:1449

Third Party Advisory

RHSA-2018:1450

Third Party Advisory

RHSA-2019:0910

Third Party Advisory

RHSA-2019:2858

RHSA-2019:3149

https://bugzilla.redhat.com/show_bug.cgi?id=1462702

Issue Tracking, Third Party Advisory

https://cwiki.apache.org/confluence/display/WW/S2-055

Third Party Advisory

https://github.com/FasterXML/jackson-databind/issues/1599

Issue Tracking

https://github.com/FasterXML/jackson-databind/issues/1723

Issue Tracking, Third Party Advisory

[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...

Mailing List, Third Party Advisory

[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15416) CVE-2017-7525 ( jackson-databind is vulnerable to Remote Code Execution) on version 3.11.4

[lucene-solr-user] 20191218 CVE-2017-7525 fix for Solr 7.7.x

[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report

[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities

[lucene-dev] 20190325 [jira] [Updated] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...

Mailing List, Third Party Advisory

[lucene-dev] 20190325 [jira] [Resolved] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...

Mailing List, Third Party Advisory

[lucene-dev] 20190325 [jira] [Assigned] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...

Mailing List, Third Party Advisory

[lucene-solr-user] 20191218 Re: CVE-2017-7525 fix for Solr 7.7.x

[lucene-solr-user] 20191219 Re: CVE-2017-7525 fix for Solr 7.7.x

[lucene-dev] 20190325 [jira] [Closed] (SOLR-13110) CVE-2017-7525 Threat Level 9 Against Solr v7.6. org.codehaus.jackson : jackson-mapper-asl : 1.9.13. .A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, ...

Mailing List, Third Party Advisory

[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update

https://security.netapp.com/advisory/ntap-20171214-0002/

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us

Third Party Advisory

DSA-4004

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Patch, Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Patch, Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Patch, Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.