^{CVE-2020-25649:}XML External Entity (XXE) vulnerability in FasterXML Jackson Databind allows attackers to exploit improper entity expansion.

Overview

CVE-2020-25649 affects FasterXML Jackson Databind, a popular Java library used for JSON and XML processing. The vulnerability occurs because the library does not properly secure XML entity expansion, making it vulnerable to XXE attacks. When processing XML input with external entity references, the parser may resolve these references and allow an attacker to access local files, make network connections to internal systems, or cause denial of service through resource exhaustion. This vulnerability is particularly concerning for applications that process untrusted XML input using Jackson Databind. The issue affects multiple versions of the library and has been widely acknowledged across various Apache projects and other software that depends on Jackson Databind.

Remediation

To remediate this vulnerability, users should update to a patched version of Jackson Databind:

• For Jackson 2.10.x users, update to version 2.10.5.1 or later
• For Jackson 2.11.x users, update to version 2.11.0 or later
• For Jackson 2.12.x users, update to version 2.12.1 or later

If immediate updating is not possible, consider implementing one of the following mitigations:

1. Configure XML parsers to disable external entity resolution
2. Implement input validation to reject XML containing DOCTYPE declarations
3. Use a security gateway or WAF to filter XML input containing suspicious entity declarations

Organizations using software that depends on Jackson Databind should check if their vendor has released patches addressing this vulnerability and apply them as soon as possible.

References

• Original issue: https://github.com/FasterXML/jackson-databind/issues/2589
• Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1887664
• Oracle Security Advisory: https://www.oracle.com/security-alerts/cpuApr2021.html
• NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20210108-0007/
• Apache Kafka fix: https://lists.apache.org/thread.html/r5f8a1608d758936bd6bbc5eed980777437b611537bf6fff40663fc71%40%3Cjira.kafka.apache.org%3E
• Apache ZooKeeper fix: https://lists.apache.org/thread.html/r86c78bf7656fdb2dab69cbf17f3d7492300f771025f1a3a65d5e5ce5%40%3Ccommits.zookeeper.apache.org%3E
• Apache Hive fix: https://lists.apache.org/thread.html/r6a6df5647583541e3cb71c75141008802f7025cee1c430d4ed78f4cc%40%3Cissues.hive.apache.org%3E
• MITRE CWE-611: https://cwe.mitre.org/data/definitions/611.html