Jackson-databind PolymorphicTypeValidator Bypass via Generic Type Parameters

Vulnerability Overview Vulnerability Name: Bypass of via generic type parameters in allows arbitrary class instantiation Vulnerability Description: The (PTV) in is the primary security mechanism protecting against polymorphic deserialization. When polymorphic types are enabled and include generic parameters, validates only the raw container class name (the substring before ) against the configured PTV. If the container type is approved, the method resolves the full canonical type string and returns the fully parameterized type via without validating the nested type parameters. The nested type parameters are subsequently resolved, instantiated, and registered as part of the deserialization process. An attacker can control the type ID to inject restricted classes as generic type parameters for an allowed container. For example, passes the PTV check if is on the allowlist. is instantiated via , and its properties are set from the attacker-controlled JSON. This completely bypasses the explicitly configured PTV allowlist. Impact Scope Bypass of PTV Allowlists: Including the recommended configured to allow rules based on name prefixes. Arbitrary Class Instantiation: Any class assignable to container elements/parameter positions, instantiated with attacker-controlled property values (injected after deserialization). Potential Unauthorized Remote Code Execution: Possible when classes with exploitable side effects (JNDI lookups, JDBC connection pool gadgets, -style loaders, etc.) are present on the classpath. Affected versions: 2.10.0 - 2.18.7 3.0.0 - 3.1.3 Remediation The vulnerability was fixed in versions 2.18.8, 2.21.4, and 3.1.4 via commit in FasterXML/jackson-databind#5989. The fix adds recursive validation for each non-trivial type parameter (as well as array element types appearing as parameters) through the complete PTV chain, with documented exceptions such as (for wildcard resolution) and types. Proof of Concept (POC) Variant Payloads (All bypass an ArrayList/HashMap allowlist): Patches 2.18.8 2.21.4 3.1.4

Goal Reached Thanks to every supporter — we hit 100%!

Jackson-databind PolymorphicTypeValidator Bypass via Generic Type Parameters

More from this source