CVE-2018-12023 : Security Advisory and Response

A vulnerability has been found in FasterXML jackson-databind versions earlier than 2.7.9.4, 2.8.11.2, and 2.9.6. If the Default Typing feature is enabled, whether globally or for a specific property, and the service includes the Oracle JDBC jar in its classpath, an attacker can exploit this to run a harmful payload by providing an LDAP service access.

Understanding CVE-2018-12023

This CVE identifies a security vulnerability in FasterXML jackson-databind that could allow an attacker to execute malicious code.

What is CVE-2018-12023?

CVE-2018-12023 is a security flaw in FasterXML jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6. It arises when the Default Typing feature is active and the Oracle JDBC jar is present in the service's classpath, enabling an attacker to execute harmful payloads.

The Impact of CVE-2018-12023

The vulnerability allows attackers to exploit the Default Typing feature in jackson-databind, potentially leading to the execution of malicious code through LDAP service access.

Technical Details of CVE-2018-12023

Familiarize yourself with the technical aspects of this CVE.

Vulnerability Description

The issue in FasterXML jackson-databind versions earlier than 2.7.9.4, 2.8.11.2, and 2.9.6 allows attackers to execute harmful payloads when Default Typing is enabled and the Oracle JDBC jar is in the classpath.

Affected Systems and Versions

FasterXML jackson-databind versions prior to 2.7.9.4, 2.8.11.2, and 2.9.6

Exploitation Mechanism

Attackers can exploit the vulnerability by leveraging the Default Typing feature and the presence of the Oracle JDBC jar in the service's classpath to execute malicious payloads.

Mitigation and Prevention

Learn how to mitigate the risks associated with CVE-2018-12023.

Immediate Steps to Take

Update FasterXML jackson-databind to versions 2.7.9.4, 2.8.11.2, or 2.9.6 to eliminate the vulnerability.
Disable the Default Typing feature if not required to reduce the attack surface.
Ensure the Oracle JDBC jar is not included in the service's classpath unless necessary.

Long-Term Security Practices

Regularly monitor for security advisories and updates related to FasterXML jackson-databind.
Conduct security assessments to identify and address vulnerabilities in third-party libraries.

Patching and Updates

Apply patches and updates provided by FasterXML to address the CVE-2018-12023 vulnerability.