CVE-2020-11619 in jackson-databind
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability CVE-2020-11619 represents a critical deserialization flaw in FasterXML jackson-databind versions prior to 2.9.10.4 that specifically targets applications utilizing Spring AOP components. This vulnerability exploits the dangerous interaction between Jackson's serialization gadgets and type handling mechanisms, creating a pathway for remote code execution through maliciously crafted serialized data. The flaw is particularly concerning because it leverages the MethodLocatingFactoryBean component from the spring-aop library, which serves as a bridge between Jackson's deserialization process and Spring's AOP framework. When Jackson encounters serialized data containing references to MethodLocatingFactoryBean, it can trigger unintended object instantiation and method invocation sequences that bypass normal security boundaries.
The technical exploitation of this vulnerability occurs through Jackson's type handling capabilities, where the library attempts to deserialize objects while maintaining type information. In vulnerable versions, the interaction between Jackson's serialization gadgets and Spring's AOP components creates a scenario where attacker-controlled data can manipulate the deserialization process to execute arbitrary code. The vulnerability specifically affects the org.springframework.aop.config.MethodLocatingFactoryBean class, which is designed to locate and invoke methods on target objects. When Jackson processes serialized data that includes references to this class, it can trigger the instantiation of objects that ultimately lead to command execution. This represents a classic gadget chain vulnerability where the deserialization process becomes a vector for code execution rather than simply data processing.
From an operational perspective, this vulnerability impacts any application that uses Jackson-databind for deserializing user-provided data and has dependencies on Spring AOP components. The attack surface is particularly broad given that Jackson is widely used across enterprise applications and the spring-aop component is common in Spring-based systems. Organizations running vulnerable versions face significant risk of remote code execution, which could result in complete system compromise, data exfiltration, and lateral movement within network environments. The vulnerability is particularly dangerous because it can be exploited through various attack vectors including web applications, APIs, and any system that accepts serialized JSON data from untrusted sources. The impact extends beyond immediate system compromise to include potential data breaches, service disruption, and regulatory compliance violations.
Mitigation strategies for CVE-2020-11619 require immediate patching of Jackson-databind to version 2.9.10.4 or later, which addresses the specific interaction between serialization gadgets and type handling. Organizations should also implement comprehensive input validation and sanitization measures to prevent malicious serialized data from reaching the deserialization layer. Security teams should consider implementing runtime protections such as JVM security managers, deserialization filters, and application firewalls to detect and block suspicious deserialization attempts. Additionally, organizations should conduct thorough code reviews to identify applications that might be vulnerable and ensure that Spring AOP components are properly configured to prevent unauthorized access to method locating functionality. The vulnerability aligns with CWE-502, which describes deserialization of untrusted data, and maps to ATT&CK technique T1203, which involves exploitation of deserialization vulnerabilities for remote code execution. Regular security assessments and dependency monitoring are essential to prevent similar vulnerabilities from emerging in the future.