CVE-2020-14061 in jackson-databind
Summary
by MITRE
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified as CVE-2020-14061 represents a critical security flaw within the FasterXML jackson-databind library version 2.x prior to 2.9.10.5. This issue specifically targets the library's handling of serialization gadgets in conjunction with type information, creating a dangerous intersection that can be exploited by malicious actors to execute arbitrary code. The vulnerability affects applications that utilize the Jackson data binding library for processing JSON data and are exposed to untrusted input streams. The flaw stems from the library's improper management of type information during deserialization processes, particularly when dealing with Oracle JMS connection factory classes that are part of the weblogic/oracle-aqjms component.
The technical exploitation of this vulnerability occurs through a sophisticated chain of deserialization attacks that leverage the interaction between Jackson's type handling mechanisms and specific Oracle JMS classes. When the library processes serialized data containing these Oracle JMS connection factory references, it fails to properly validate or sanitize the type information, allowing attackers to inject malicious payloads that can be executed during the deserialization phase. This vulnerability is particularly dangerous because it operates at the serialization level, meaning that an attacker can craft a malicious JSON payload that, when processed by the vulnerable Jackson library, triggers the execution of arbitrary code on the target system. The affected Oracle JMS classes include AQjmsQueueConnectionFactory, AQjmsXATopicConnectionFactory, AQjmsTopicConnectionFactory, AQjmsXAQueueConnectionFactory, and AQjmsXAConnectionFactory, which are all part of Oracle's Advanced Queuing JMS implementation.
The operational impact of this vulnerability extends far beyond simple code execution, as it provides attackers with a pathway to gain full control over affected systems. Applications utilizing vulnerable versions of jackson-databind become susceptible to remote code execution attacks, potentially allowing adversaries to establish persistent backdoors, exfiltrate sensitive data, or use the compromised systems as launch points for further attacks within the network infrastructure. The vulnerability's severity is compounded by the widespread adoption of Jackson across enterprise applications and web services, making it a prime target for automated exploitation campaigns. Organizations running applications that process untrusted JSON input through vulnerable Jackson versions face significant risk of data breaches, system compromise, and potential regulatory violations due to the lack of proper input validation and sanitization.
Mitigation strategies for CVE-2020-14061 primarily focus on immediate remediation through version upgrades to Jackson 2.9.10.5 or later, which includes patches addressing the type handling inconsistencies. Security teams should also implement strict input validation measures, including disabling the use of the default typing feature in Jackson when processing untrusted data, and employing explicit type registration rather than relying on automatic type detection. Organizations should consider implementing network segmentation and monitoring to detect anomalous deserialization activities that might indicate exploitation attempts. The vulnerability aligns with CWE-502, which describes deserialization of untrusted data, and maps to ATT&CK technique T1059.007 for command and script injection, as the primary exploitation method involves executing arbitrary code through the deserialization process. Additionally, organizations should conduct comprehensive vulnerability assessments to identify all applications using affected Jackson versions and establish robust patch management processes to prevent similar issues in the future.