Deserialization of Untrusted Data (Java JSON Deserialization) Jackson
Description
This vulnerability occurs when a web application uses the Jackson JSON library to deserialize user-supplied data with Polymorphic Type Handling enabled. Polymorphic Type Handling allows JSON data to specify which Java class should be instantiated during deserialization, which can be exploited by attackers to instantiate dangerous classes. When processing untrusted input, this feature can lead to remote code execution through deserialization gadgets—specially crafted JSON payloads that trigger malicious code execution when deserialized. This is a well-known attack vector affecting Jackson versions prior to proper security hardening.
Remediation
Take the following steps to remediate this vulnerability:<br/><br/>1. <strong>Upgrade Jackson databind library</strong> to the latest stable version (2.10.0 or higher recommended) which includes fixes for known deserialization gadgets.<br/><br/>2. <strong>Disable default typing (Polymorphic Type Handling)</strong> unless absolutely required. Remove calls to <code>enableDefaultTyping()</code> or <code>enableDefaultTypingAsProperty()</code>:<br/><pre>// VULNERABLE CODE - Remove this ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(); // DO NOT USE // SECURE CODE ObjectMapper mapper = new ObjectMapper(); // Do not enable default typing</pre><br/>3. If polymorphic deserialization is required, use <strong>PolymorphicTypeValidator</strong> (Jackson 2.10+) to whitelist allowed classes:<br/><pre>PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder() .allowIfSubType("com.yourcompany.safe.package") .build(); ObjectMapper mapper = JsonMapper.builder() .polymorphicTypeValidator(ptv) .activateDefaultTyping(ptv, DefaultTyping.NON_FINAL) .build();</pre><br/>4. <strong>Validate and sanitize all input</strong> before deserialization and implement strict input validation rules.<br/><br/>5. Apply the principle of least privilege to the application's runtime environment to limit the impact of potential exploitation.