FasterXML Jackson-databind Information Disclosure Vulnerability

FasterXML has disclosed a vulnerability, tracked as CVE-2024-42572, affecting the Jackson-databind library. The vulnerability allows a remote, unauthenticated attacker to cause an information disclosure through the manipulation of polymorphic type handling mechanisms. This issue typically occurs when the library is configured to process untrusted JSON input that leverages specific class types to leak information from the application environment. Defenders should review applications utilizing Jackson-databind to ensure they are updated to a non-vulnerable version, as the library is a pervasive component in Java-based web applications and API frameworks.

Impact

Successful exploitation could result in the disclosure of sensitive application data, which may include memory contents, environment variables, or other sensitive configuration details accessible to the application process. While the exact scope of affected environments depends on specific application implementation, the widespread use of Jackson-databind in enterprise Java applications makes this a relevant concern for security teams maintaining server-side infrastructure.

Recommendation

• Identify applications using vulnerable versions of Jackson-databind through software composition analysis (SCA) or build-time dependency manifests.
• Upgrade Jackson-databind to the latest patched version provided by the FasterXML project to address CVE-2024-42572.
• Validate that Jackson polymorphic type handling features (enableDefaultTyping) are disabled or restricted to a strict allowlist of classes.