Java: Unsafe deserialization with Jackson #368
Description
Query
CVE ID(s)
Report
Deserialization of untrusted data with Jackson is known to be dangerous:
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
I'd like to propose to add sinks for Jackson to UnsafeDeserialization.ql.
There are multiples CVEs for deserialization gadgets for Jackson Databind:
Those CVEs create quite a lot of noise because many applications don't use polymorphic typing. The query would help check if applications are really affected by such CVEs. On the other hand, if an application actually turns on polymorphic typing, and deserializes data from remote peers, that would be a significant security risk that can be identified by this query.
- Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
I am planning to write wrote a blog post about detecting such issues.
Result(s)
- The query detects CVE-2016-8749 in Apache Camel
2.16.4.