Incorrect authorization in jackson-databind - #VU139150

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass write-side authorization restrictions and populate view-restricted properties from untrusted input.

The vulnerability exists due to improper access control in BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId when processing JSON input with creator properties annotated with @JsonView and @JsonTypeInfo(include=As.EXTERNAL_PROPERTY). A remote attacker can send specially crafted JSON input to bypass write-side authorization restrictions and populate view-restricted properties from untrusted input.

Exploitation requires a property-based @JsonCreator on the outer type, a creator parameter annotated with a restricted @JsonView, and the same parameter annotated with polymorphic @JsonTypeInfo using As.EXTERNAL_PROPERTY.

Remediation

Sources

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w
• https://github.com/FasterXML/jackson-databind/commit/7dc7a17