SecBoard
Zurück zur CVE-Übersicht

CVE-2020-14062

HIGH(8.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 8.1 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

8.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.1

Technische Schwere

Beschreibung

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 2.9.10.5
  • 2.4.2-2+deb8u15

Threat-Hunting-Queries

Die Schwachstelle betrifft die Deserialisierung von untrusted Daten in FasterXML jackson-databind, was zur Ausführung von Gadgets führen kann. Die Detektion konzentriert sich auf ungewöhnliche Prozessstarts oder Netzwerkverbindungen, die auf eine erfolgreiche Ausnutzung hindeuten könnten, insbesondere im Kontext von Java-Anwendungen, die Jackson-databind verwenden.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName contains "java" and FileName in ("sh", "bash", "powershell.exe", "cmd.exe")
| where ProcessCommandLine contains "JNDIConnectionPool" or ProcessCommandLine contains "xalan"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=* (sourcetype=linux_audit OR sourcetype=WinEventLog:Security) (process="java" AND (command="sh" OR command="bash" OR command="powershell.exe" OR command="cmd.exe")) | search (commandline="*JNDIConnectionPool*" OR commandline="*xalan*")

Sigma

title: Jackson Databind Gadget Exploitation
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith: '\java.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: selection
  falsepositives:
    - Legitimate Java applications executing shell commands (requires tuning)
level: high

Elastic ES|QL

from process where process.parent.executable.name : "java" and process.executable.name in ("sh", "bash", "powershell.exe", "cmd.exe") and (process.args : "*JNDIConnectionPool*" or process.args : "*xalan*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_calendar_server:8.0.0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_contacts_server:8.0.0.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*

GitHub Advisories

GHSA-c265-37vj-cwccHIGH

Deserialization of untrusted data in Jackson Databind

maven/com.fasterxml.jackson.core:jackson-databind→ 2.9.10.5
GitHub Advisory

Referenzen