CVE-2020-36184

What it actually does

This vulnerability is classified as a deserialization issue. In affected Jackson databind deployments, unsafe handling of attacker-controlled serialized JSON with polymorphic/default typing can allow construction of unexpected Java types during deserialization. If a suitable gadget class is present on the application classpath, this can lead to arbitrary code execution, unauthorized outbound connections, file access, or application compromise under the privileges of the Java process. The provided affected product data also lists Debian 9 gst-plugins-base1.0 as affected and fixed in a Debian security update, so package-level exposure should be validated separately through the operating system package inventory.

Why it matters to the business

Successful exploitation can allow an attacker to take control of an affected application process, potentially leading to data theft, service disruption, lateral movement, or deployment of additional malware. The issue is old, publicly known, and has available exploit material, so unpatched internet-facing or API-exposed services that deserialize untrusted input should be treated as higher priority even though it is not currently listed in CISA KEV and is not marked as ransomware-associated. The EPSS score of 0.10379 indicates a meaningful likelihood of exploitation relative to many vulnerabilities, especially where vulnerable libraries remain embedded in applications.

How an attack unfolds

An attacker first identifies an application endpoint, message queue consumer, API, or file-processing workflow that accepts JSON or serialized data and processes it with a vulnerable Jackson databind version using unsafe polymorphic deserialization behavior. The attacker then crafts a payload that includes type metadata referencing a gadget class available in the target runtime. When the application deserializes the payload, Jackson instantiates the attacker-selected type and triggers side effects in its constructors, setters, or initialization paths. Depending on the available gadget chain and runtime permissions, this may result in command execution, forced network callbacks, file reads or writes, application crash, or a foothold inside the application. In Debian environments where gst-plugins-base1.0 is affected, exploitation would depend on reaching the vulnerable media-processing path with a crafted media or subtitle/container input rather than a JSON API path.

How to fix it

Upgrade affected components to fixed versions. For Debian 9 gst-plugins-base1.0, install version 1.10.4-1+deb9u2 or later from the appropriate Debian security repository. For FasterXML jackson-databind source-based deployments, update to a version containing commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87 or, preferably, a currently supported jackson-databind release rather than relying on an old branch. Also remove or disable unsafe default typing for untrusted input, replace broad polymorphic deserialization with explicit allowlists of expected types, and avoid deserializing attacker-controlled data into generic Object, Serializable, Comparable, or interface/base-class targets. If immediate upgrade is not possible, restrict access to vulnerable endpoints, block suspicious polymorphic type metadata at the edge where safe, isolate parsing workers, remove unnecessary gadget libraries from the classpath, and run affected services with least-privilege filesystem, network, and OS permissions.

How to confirm the fix worked

Confirm remediation by inventorying deployed packages, application artifacts, and container images. For Debian systems, verify that gst-plugins-base1.0 is at 1.10.4-1+deb9u2 or later using package manager output. For Java applications, inspect SBOMs, build manifests, dependency lock files, shaded JARs, and running application classpaths for vulnerable jackson-databind versions or source builds missing commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87. Test application behavior with safe, non-executing deserialization probes to confirm that untrusted type metadata is rejected and that only explicitly allowed classes can be deserialized. Rebuild and redeploy containers or application bundles after dependency updates; do not rely only on updating a base image if the vulnerable library is packaged inside the application artifact.

Typical attack path

1. Reconnaissance: identify applications, APIs, message consumers, or file-processing services that use vulnerable Jackson databind or the affected Debian package.
2. Dependency confirmation: infer vulnerable library/package versions from error banners, dependency disclosures, SBOMs, application behavior, or package metadata leaks.
3. Reachability testing: send benign probes containing unusual JSON type metadata, malformed serialized content, or crafted media inputs and observe errors, callbacks, or parsing behavior.
4. Payload construction: build a deserialization payload that references a gadget class present on the target classpath or a crafted file/input that reaches the vulnerable parser.
5. Delivery: submit the payload through an exposed HTTP endpoint, API request body, message broker, uploaded file, scheduled import, or media-processing workflow.
6. Trigger: wait for the application or worker process to deserialize or parse the attacker-controlled content.
7. Post-exploitation: execute commands, establish outbound callbacks, drop files, access sensitive data, pivot using the compromised application identity, or disrupt service.

How to detect it

Review application, web access, API gateway, WAF, message broker, and Java runtime logs for suspicious deserialization activity. Look for JSON payloads containing Jackson polymorphic type metadata such as @class, @type, @JsonTypeInfo-style fields, unusual fully qualified Java class names, or references to known gadget libraries. Investigate HTTP 400/500 error spikes with exceptions such as InvalidTypeIdException, JsonMappingException, MismatchedInputException, ClassNotFoundException, or messages about denied or illegal subtype resolution. On hosts and containers, hunt for Java application processes spawning shell or scripting interpreters, unexpected file writes in temporary directories, anomalous DNS/HTTP callbacks from application servers, new cron/systemd entries, dropped JARs, web shells, or unusual outbound connections soon after malformed requests. For Debian gst-plugins-base1.0 exposure, review media-processing service logs for crashes or parsing errors associated with untrusted media, subtitle, or container files and correlate with core dumps or abnormal worker restarts. Because exploitation may leave few application-level artifacts if the payload succeeds, correlate network, endpoint, process, and application telemetry around suspicious request times.

• "@class"
• "@type"
• "JsonMappingException"
• "InvalidTypeIdException"
• "MismatchedInputException"
• "ClassNotFoundException"
• "Could not resolve type id"
• "Illegal type"
• "denied resolution"
• "com.fasterxml.jackson.databind"
• "enableDefaultTyping"
• "activateDefaultTyping"
• "org.apache.commons.dbcp"
• "java.lang.Runtime"
• "java.lang.ProcessBuilder"
• "/bin/sh"
• "/bin/bash"
• "cmd.exe"
• "powershell.exe"
• "curl "
• "wget "
• "/tmp/"
• "java.lang:type=Memory"

What your security team should do

• Prioritize externally reachable services, APIs, file upload handlers, message consumers, and media-processing workflows that process untrusted input with the affected components.
• Upgrade Debian gst-plugins-base1.0 to 1.10.4-1+deb9u2 or later where present, and update jackson-databind to a fixed and currently supported release or a build containing commit 7ae9214c0670eeb679dd131ab0aee3565cc7af87.
• Generate or refresh SBOMs for Java applications and container images to identify embedded, shaded, or transitive jackson-databind copies that package scanners may miss.
• Review code for unsafe Jackson default typing, broad base-type deserialization, and deserialization of untrusted request bodies or message payloads.
• Temporarily restrict network access to vulnerable endpoints and workers until patching is complete, especially for internet-facing systems.
• Add detection for suspicious Jackson polymorphic type metadata, Java process child-process execution, unexpected outbound callbacks, and deserialization exception spikes.
• Hunt historical logs for exploitation attempts because the issue has been public since 2021 and exploit material is available.
• Run affected services with least privilege and egress controls to reduce impact if deserialization is reached.