Summary
A critical unsafe deserialization flaw in Jackson Databind allows attacker-controlled generic type arguments or array element types to bypass polymorphic type validation. In affected configurations, this may deserialize classes that should be rejected and could enable arbitrary code execution when dangerous classes and attacker-controlled data are available.
A critical unsafe deserialization flaw in Jackson Databind allows attacker-controlled generic type arguments or array element types to bypass polymorphic type validation. In affected configurations, this may deserialize classes that should be rejected and could enable arbitrary code execution when dangerous classes and attacker-controlled data are available.
Affected context
The issue occurs in Jackson Databind polymorphic deserialization paths that accept class-name type identifiers. It can affect annotation-based class-name polymorphism, configured default typing in Jackson 2.x and 3.x, and integrations that expose default typing, particularly when generic wrappers, maps, or arrays are permitted and application dependencies provide security-sensitive classes.
The issue occurs in Jackson Databind polymorphic deserialization paths that accept class-name type identifiers. It can affect annotation-based class-name polymorphism, configured default typing in Jackson 2.x and 3.x, and integrations that expose default typing, particularly when generic wrappers, maps, or arrays are permitted and application dependencies provide security-sensitive classes.
Exploit preconditions
- Attack surface: Application endpoints, messages, or other inputs that trigger Jackson polymorphic deserialization
- Required access: Ability to submit or influence serialized data containing class-name type information; authentication requirements depend on the application
- Trigger point: Resolution of generic arguments, map types, or array element types during deserialization
- Why exploitation is possible: Validation checks the outer type but may validate embedded types against the wrong base type, or may substitute a permissive validator after the outer type is approved
- Additional conditions: Impact depends on enabled polymorphic typing, reachable classes on the classpath, available gadget behavior, and the privileges of the hosting process
- Attack surface: Application endpoints, messages, or other inputs that trigger Jackson polymorphic deserialization
- Required access: Ability to submit or influence serialized data containing class-name type information; authentication requirements depend on the application
- Trigger point: Resolution of generic arguments, map types, or array element types during deserialization
- Why exploitation is possible: Validation checks the outer type but may validate embedded types against the wrong base type, or may substitute a permissive validator after the outer type is approved
- Additional conditions: Impact depends on enabled polymorphic typing, reachable classes on the classpath, available gadget behavior, and the privileges of the hosting process
Why this happens
The underlying bug is incomplete validation of nested polymorphic type information, mapping to CWE-502: Deserialization of Untrusted Data. Jackson validates the outer class-name type ID against the declared base type, but generic arguments may be checked against that outer base type instead of their corresponding declared bindings. Validators may also receive argument types before the required subtype relationship has been established. In some allow-listed outer-type paths, a permissive validator is substituted, and plain array element types can remain unchecked. This creates a trust boundary failure in which attacker-selected classes embedded inside an otherwise acceptable type are deserialized.
The underlying bug is incomplete validation of nested polymorphic type information, mapping to CWE-502: Deserialization of Untrusted Data. Jackson validates the outer class-name type ID against the declared base type, but generic arguments may be checked against that outer base type instead of their corresponding declared bindings. Validators may also receive argument types before the required subtype relationship has been established. In some allow-listed outer-type paths, a permissive validator is substituted, and plain array element types can remain unchecked. This creates a trust boundary failure in which attacker-selected classes embedded inside an otherwise acceptable type are deserialized.
Potential impact
- An attacker may cause deserialization of classes that violate the declared generic type
- Application integrity or confidentiality may be compromised
- Sensitive data may be accessed or manipulated through reachable gadget classes
- Arbitrary code execution could occur when a suitable gadget chain and application conditions are present
- The application process or connected services may be affected with the process account's privileges
- An attacker may cause deserialization of classes that violate the declared generic type
- Application integrity or confidentiality may be compromised
- Sensitive data may be accessed or manipulated through reachable gadget classes
- Arbitrary code execution could occur when a suitable gadget chain and application conditions are present
- The application process or connected services may be affected with the process account's privileges
General mitigation guidance
Mitigation generally focuses on removing unsafe polymorphic deserialization and ensuring that every nested type is constrained by its declared binding.
Common defensive patterns include:
- Prefer non-polymorphic, schema-bound data formats and explicit data transfer types
- Use narrowly scoped type allowlists for required polymorphic cases
- Validate generic arguments, map keys, and array element types against their declared types
- Avoid permissive default typing and broad base-type approvals
- Reduce input trust by rejecting client-supplied class names whenever possible
- Isolate deserialization from sensitive classes and restrict dangerous dependencies from exposed runtimes
- Run affected services with least privilege and limit filesystem, process, and network permissions
- Apply framework-level and dependency-level security policies that prevent unsafe type activation
Mitigation generally focuses on removing unsafe polymorphic deserialization and ensuring that every nested type is constrained by its declared binding.
Common defensive patterns include:
- Prefer non-polymorphic, schema-bound data formats and explicit data transfer types
- Use narrowly scoped type allowlists for required polymorphic cases
- Validate generic arguments, map keys, and array element types against their declared types
- Avoid permissive default typing and broad base-type approvals
- Reduce input trust by rejecting client-supplied class names whenever possible
- Isolate deserialization from sensitive classes and restrict dangerous dependencies from exposed runtimes
- Run affected services with least privilege and limit filesystem, process, and network permissions
- Apply framework-level and dependency-level security policies that prevent unsafe type activation
How teams detect issues like this
Detection can combine dependency inventory with analysis of deserialization configuration and application input paths.
Useful approaches include:
- Static analysis for default typing, class-name polymorphism, permissive subtype validators, and broad base-type allowlists
- Code review of generic, map, and array deserialization paths for validation of nested type parameters
- Searches for externally controlled JSON or message inputs that reach polymorphic Jackson readers
- Runtime monitoring for unexpected class resolution, reflective construction, process creation, or unusual file and network access
- Policy enforcement that rejects broad polymorphic typing in exposed services and requires explicit type registrations
- Automated security review tools can help identify unsafe parser configuration and dangerous type-resolution patterns
Detection can combine dependency inventory with analysis of deserialization configuration and application input paths.
Useful approaches include:
- Static analysis for default typing, class-name polymorphism, permissive subtype validators, and broad base-type allowlists
- Code review of generic, map, and array deserialization paths for validation of nested type parameters
- Searches for externally controlled JSON or message inputs that reach polymorphic Jackson readers
- Runtime monitoring for unexpected class resolution, reflective construction, process creation, or unusual file and network access
- Policy enforcement that rejects broad polymorphic typing in exposed services and requires explicit type registrations
- Automated security review tools can help identify unsafe parser configuration and dangerous type-resolution patterns
