CVE-2020-36182

What it actually does

This issue is in the deserialization class of vulnerabilities: vulnerable software can deserialize attacker-influenced data in a way that instantiates unexpected classes or triggers unsafe object behavior. In Jackson databind-style cases, the highest-risk condition is use of polymorphic/default typing or equivalent handling of untrusted JSON where attacker-supplied type metadata can select classes present on the application classpath. Depending on the reachable gadget classes and runtime configuration, impact can range from denial of service and unexpected outbound connections to arbitrary code execution in the context of the vulnerable application process. For Debian gst-plugins-good1.0, treat affected media-processing components as potentially exposed through parsing of untrusted media/content until updated to the fixed package.

Why it matters to the business

A successful exploit can let an attacker take control of an application process, disrupt services, or use the affected workload as a foothold to access data and adjacent systems. The CVE is older and not currently listed in CISA KEV, but exploit material is available and the EPSS score indicates non-trivial opportunistic exploitation likelihood. Because Jackson databind is commonly embedded as a transitive dependency, exposure may exist inside applications even when it is not directly declared by developers.

How an attack unfolds

An attacker first identifies an application endpoint, message consumer, API, file-ingestion workflow, or media-processing path that accepts attacker-controlled serialized content. For Jackson databind exposure, the attacker submits crafted JSON containing type metadata, such as a polymorphic type identifier, intended to force the application to instantiate a dangerous class available in the runtime dependency set. If default typing or permissive polymorphic deserialization is enabled and the vulnerable version has not blocked the relevant class pattern, deserialization may invoke gadget behavior before normal business logic validates the object. The attacker then uses that behavior to execute code, trigger network callbacks, read or write local resources, or crash the process depending on the available gadget chain and sandboxing. For packaged Debian gst-plugins-good1.0 exposure, the analogous path is delivery of malicious content to a vulnerable parser through a service or user workflow that processes untrusted media.

How to fix it

Upgrade affected components to fixed versions. For Debian 9 gst-plugins-good1.0, install version 1.10.4-1+deb9u1 or later from the appropriate security repository. For fasterxml/jackson-databind from source, ensure the code includes fixed commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or use a vendor/library release that contains that fix. Also audit applications for transitive jackson-databind copies and shaded JARs, not only direct dependencies. Where immediate upgrade is not possible, disable Jackson default typing for untrusted data, replace deprecated enableDefaultTyping usage with explicit allowlisted subtype handling, reject or strip attacker-controlled type metadata, isolate parsers in low-privilege sandboxes, and restrict outbound network access from application runtimes to reduce gadget-chain impact.

How to confirm the fix worked

Confirm the installed package or dependency version is no longer affected: use OS package inventory for gst-plugins-good1.0 and build/dependency tooling such as Maven, Gradle, SCA, SBOM, or JAR manifest inspection for jackson-databind. Validate that no deployed artifact contains an older shaded or bundled jackson-databind copy. Review code and configuration for ObjectMapper default typing, permissive polymorphic deserialization, or acceptance of @class-style type identifiers from untrusted input. If safe test procedures are available, run a benign deserialization probe that verifies attacker-controlled type metadata is rejected rather than instantiated. For Debian systems, verify the fixed package version reports 1.10.4-1+deb9u1 or later; for source builds, verify inclusion of commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or an equivalent released patch.

Typical attack path

1. Find an internet-facing API, backend message consumer, upload parser, or media-processing workflow that accepts attacker-controlled content.
2. Confirm that the target uses an affected version of jackson-databind, Debian gst-plugins-good1.0, or a product embedding one of those components.
3. For Jackson-style exploitation, craft serialized JSON with polymorphic type metadata referencing a gadget class likely to exist on the classpath.
4. Send the payload to the vulnerable deserialization path and observe errors, timing differences, process crashes, or outbound callback behavior.
5. Refine the payload to trigger the intended gadget behavior, such as command execution, file access, denial of service, or network interaction.
6. Use the compromised application process privileges to persist, access sensitive data, move laterally, or disrupt service operations.

How to detect it

Investigate both application-layer and host-layer evidence. For Jackson exposure, review web/API logs, message broker payload logs where retained, application exception logs, EDR telemetry, JVM crash logs, and outbound DNS/HTTP connection records from application servers. Look for requests containing polymorphic type metadata, especially @class, @type, type, or fully qualified Java class names in JSON submitted to endpoints that normally do not accept them. Search application logs for Jackson deserialization exceptions such as InvalidTypeIdException, JsonMappingException, blocked subtype messages, or references to com.fasterxml.jackson.databind around suspicious requests. Correlate those events with outbound network callbacks, unexpected child processes spawned by Java services, new files written under temporary directories, service crashes, or sudden CPU/memory exhaustion. For gst-plugins-good1.0 exposure, review logs from services that process uploaded or remote media and look for parser crashes, segmentation faults, malformed media errors, or repeated failures immediately after user-supplied content is processed. Because exploit payloads vary by available gadget chain and this CVE does not provide a single universal network signature, prioritize behavioral correlation over a single IOC.

• com.fasterxml.jackson.databind.exc.InvalidTypeIdException
• com.fasterxml.jackson.databind.JsonMappingException
• enableDefaultTyping
• activateDefaultTyping
• @class
• @type
• Could not resolve type id
• Could not resolve subtype
• Illegal type
• SubTypeValidator
• DefaultTyping
• PolymorphicTypeValidator
• java.lang.Runtime
• java.lang.ProcessBuilder
• /tmp/hs_err_pid
• hs_err_pid
• gst-plugin-scanner
• gst-launch-1.0
• gst-discoverer-1.0
• gst-plugins-good
• Segmentation fault
• SIGSEGV

What your security team should do

• Inventory all direct, transitive, bundled, and shaded uses of jackson-databind and all deployed Debian gst-plugins-good1.0 packages.
• Prioritize remediation for internet-facing services, message consumers, file upload handlers, API gateways, and media-processing workloads that process untrusted input.
• Upgrade Debian gst-plugins-good1.0 to 1.10.4-1+deb9u1 or later and ensure jackson-databind contains fixed commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or a vendor release including it.
• Search codebases for unsafe Jackson patterns such as enableDefaultTyping, activateDefaultTyping, permissive subtype validators, and acceptance of @class or similar type metadata from users.
• Add compensating controls while patching: WAF/API validation for suspicious type metadata, egress filtering, least-privilege service accounts, container isolation, and parser sandboxing.
• Hunt historical logs for deserialization exceptions, unusual type-id errors, outbound callbacks from application servers, crashes during parsing, and requests containing type metadata fields.
• Add regression tests to ensure untrusted payloads cannot select arbitrary Java classes or parser behaviors.