Bypass FasterXML Jackson-databind Illegal Type Validator
Bypass FasterXML Jackson-databind Illegal Type Validator Abstract FasterXML jackson-databind blocked gadgets are back (drafted: April 2025 )! In 2017, a deserialization vulnerability in FasterXML's jackson-databind library was reported ( CVE-2017-7525 ) resulting in an unsafe deserialization in Java leading to numerous exploit scenarios including RCE. The fix for the vulnerability was to create a blocklist of dangerous java classes. This resulted in more CVEs and fixes as new gadgets were discovered and ultimately blocked in each new version. Over time, the concern for this vulnerability faded away as it appeared fixed. Recently, I found a way to bypass the fix allowing for previously blocked gadgets to return. Background The Jackson databind library is most commonly used to take json and convert it to a java object. This form of deserialization is accomplished by instantiating its java object and setting its variables using the val...