CVE-2020-36179

What it actually does

This is an unsafe deserialization issue in affected data-binding/package components. In Jackson databind deployments, the practical risk is highest when applications deserialize untrusted JSON while polymorphic type handling/default typing is enabled and vulnerable gadget classes are present on the application classpath. An attacker can supply crafted serialized type metadata that causes the application to instantiate attacker-influenced classes during deserialization. Depending on reachable classes, runtime configuration, and outbound network controls, this can lead to remote code execution, JNDI-based callback/lookup behavior, server-side request forgery, credential exposure, denial of service, or unexpected object construction. The listed Debian libmodule-signature-perl package is also affected in Debian 6.0 and is fixed by the vendor package update.

Why it matters to the business

Successful exploitation can allow an attacker to turn a normal data-processing endpoint into an execution or callback point, potentially compromising application servers, exposing secrets, disrupting services, or enabling lateral movement. Because public exploit techniques are available and the EPSS probability is non-trivial, internet-facing services that accept JSON or other serialized input should be prioritized even though this vulnerability is not currently listed in CISA KEV and is not known from the provided data to be ransomware-associated.

How an attack unfolds

An attacker first identifies an application or service that uses an affected version of Jackson databind or the affected Debian package and accepts attacker-controlled serialized input. For Jackson-based applications, the attacker looks for endpoints that deserialize JSON into objects using default typing or otherwise honor embedded type information. The attacker then sends crafted input containing type metadata for a gadget class available in the target runtime, commonly using data-source or JNDI-capable gadget patterns. During deserialization, the vulnerable library resolves and instantiates the attacker-selected type. If the required gadget and environmental conditions are present, this can cause outbound lookups, loading of attacker-controlled references, execution of attacker-influenced logic, or service instability. The attacker may then use the resulting access to run commands, retrieve secrets, establish persistence, or pivot to adjacent systems. Exploitability is highly dependent on configuration, classpath contents, network egress, and whether untrusted data reaches the vulnerable deserialization path.

How to fix it

Upgrade affected components to fixed versions. For Debian 6.0, update libmodule-signature-perl to 0.63-1+squeeze2 or later vendor-fixed builds. For FasterXML jackson-databind from source, include the fix at commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or use a downstream release that contains that fix; in practice, prefer upgrading to a currently supported Jackson release line rather than remaining on an old patched branch. Disable unsafe default typing for untrusted input, avoid accepting attacker-controlled polymorphic type identifiers, and use explicit allowlists for permitted subtypes. Remove unnecessary gadget-prone libraries from application classpaths where feasible. Restrict outbound egress from application servers, especially LDAP, RMI, DNS, HTTP, and other callback channels commonly used in deserialization exploitation. Add request-size, schema-validation, and content-validation controls for externally supplied JSON and serialized data.

How to confirm the fix worked

Confirm package versions with operating-system package managers, dependency manifests, SBOM tooling, and runtime classpath inspection. Verify Debian systems report libmodule-signature-perl version 0.63-1+squeeze2 or later. Verify Jackson databind builds include commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or a vendor release containing the fix. Review application code and framework configuration for use of enableDefaultTyping, activateDefaultTyping, ObjectMapper default typing, permissive subtype validators, or deserialization of untrusted data. Run dependency scanners against build artifacts, containers, and deployed hosts. Validate compensating controls by confirming that application servers cannot make unauthorized outbound LDAP/RMI/DNS/HTTP callbacks and that malformed polymorphic JSON is rejected or logged without object instantiation.

Typical attack path

1. Fingerprint target applications for Java/Jackson usage or affected Debian package versions through headers, errors, dependencies, SBOMs, or behavioral probing.
2. Identify endpoints that accept JSON or serialized data and appear to perform server-side object binding.
3. Test whether polymorphic type metadata is honored, often by sending benign type probes and watching for distinctive exceptions or outbound callbacks.
4. Craft input referencing a reachable gadget class associated with vulnerable deserialization behavior.
5. Trigger deserialization by submitting the crafted request to the vulnerable endpoint or message consumer.
6. Use resulting callback, code execution, SSRF, or denial-of-service behavior to expand access or disrupt operations.
7. Cover tracks by deleting payloads, rotating infrastructure, or blending exploit attempts into normal API traffic.

How to detect it

Investigate whether exploitation has already occurred by reviewing web access logs, API gateway logs, WAF events, application logs, Java exception traces, message broker payload logs, EDR telemetry, DNS logs, proxy logs, and firewall/egress records. Look for JSON requests containing polymorphic type markers such as @type, class names associated with Apache Commons DBCP data-source gadgets, JNDI-style URLs, or unexpected outbound LDAP/RMI/DNS/HTTP connections from application servers shortly after inbound requests. In application logs, search for Jackson deserialization errors such as InvalidTypeIdException, JsonMappingException, ClassNotFoundException, IllegalArgumentException during subtype resolution, and stack traces involving com.fasterxml.jackson.databind. For endpoint telemetry, look for child processes spawned by Java runtimes, suspicious shell execution, download utilities, unexpected network connections, or new files created by the application user. For Debian hosts, review package manager logs for vulnerable package installation windows and correlate with suspicious mail, archive, or signature-verification activity where the affected Perl package is used. Absence of these artifacts does not prove non-exploitation because successful deserialization attacks may leave only normal-looking API requests and outbound callbacks unless detailed request logging or egress monitoring is enabled.

• "@type"
• "@class"
• "com.fasterxml.jackson.databind.exc.InvalidTypeIdException"
• "com.fasterxml.jackson.databind.JsonMappingException"
• "com.fasterxml.jackson.databind"
• "enableDefaultTyping"
• "activateDefaultTyping"
• "org.apache.commons.dbcp.datasources.SharedPoolDataSource"
• "org.apache.commons.dbcp.datasources.PerUserPoolDataSource"
• "org.apache.commons.dbcp2.datasources.SharedPoolDataSource"
• "org.apache.commons.dbcp2.datasources.PerUserPoolDataSource"
• "ldap://"
• "rmi://"
• "iiop://"
• "dns://"
• "java.lang.ClassNotFoundException"
• "Cannot construct instance of"
• "Could not resolve type id"
• "Missing type id property '@type'"
• "Type id handling not implemented for type"
• "java -jar"
• "/bin/sh -c"
• "cmd.exe /c"
• "powershell.exe"
• "curl "
• "wget "

What your security team should do

• Inventory all applications, containers, and build artifacts using jackson-databind and affected Debian libmodule-signature-perl packages.
• Prioritize internet-facing APIs, message consumers, and services that deserialize untrusted JSON or other serialized input.
• Upgrade to fixed versions: libmodule-signature-perl 0.63-1+squeeze2 or later, and Jackson databind builds containing commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or a supported fixed release.
• Disable unsafe default typing and replace broad polymorphic deserialization with explicit subtype allowlists.
• Search logs for historical exploit probes containing Jackson type metadata, DBCP data-source gadget class names, JNDI URLs, and deserialization exceptions.
• Restrict application-server egress to approved destinations and block unnecessary LDAP, RMI, and external DNS callback paths.
• Remove unnecessary libraries that introduce deserialization gadget classes from production classpaths.
• Add regression tests or security unit tests to ensure untrusted input cannot control deserialized Java types.
• Monitor for public exploit activity because exploit code is available and EPSS indicates meaningful likelihood of exploitation.