Penetration Test Report (ADALogics): Jackson Report Shared

PRESENTS
Jackson-Core and Jackson-Databind
Security Audit
In collaboration with the Jackson projects maintainers and The Open Source Technology
Improvement Fund, Inc (OSTIF).
ostif.org
Authors
Adam Korczynski <adam@adalogics.com>
David Korczynski <david@adalogics.com>
Date: 1st November 2022
This report is licensed under Creative Commons 4.0 (CC BY 4.0)
1
Table of contents
Executive summary 3
Project Summary 4
Audit scope 5
Initial assessment 6
Fuzzing continuously with OSS-Fuzz 7
Threat model formalisation 11
Found issues 16
2
Executive summary
In august and september 2022, OSTIF solicited Ada Logics to carry out a security audit for
the Jackson-core and Jackson-databind projects. Jackson-databind and Jackson-core are
libraries used for data parsing and data binding. The primary use case is for JSON data, but
other types of data such as XML, CSV and protobuf can be parsed as well. The goal of the
engagement was to conduct a holistic security assessment of both projects, which for each
project involved four high-level tasks:
● Threat model formalisation.
● Manual code auditing.
● Building a comprehensive and substantial fuzzing suite.
● Integrate the fuzzing suite into Jacksons CI integration.
Throughout the audit, Ada Logics’ auditing team met with Tatu Saloranta from the Jackson
projects to discuss the process as well as findings.
Key findings
The main assessment from this audit is that Jackson-core and Jackson-databind have a
strong security posture. Some issues were found during the engagement, but the overall
conclusion is that the libraries are well-written and safe to use. The audit found 12 issues
that could affect Jackson users’ security. The below table overview illustrates the severity of
the findings.
Severity
Severity # of findings
High 3
Medium 5
Informational 4
Issue categorization
Type # of findings
Missing bounds checks 4
Stack overflow DoS issues 4
Usability risks 4
Notable issues
The primary security findings of this audit are 2 high-severity CVEs in Jackson-databind that
can lead to denial of service, and both of these issues were found by way of fuzzing:
● CVE-2022-42003 | CVSS: 7.5 HIGH
● CVE-2022-42004 | CVSS: 7.5 HIGH
3
Project Summary
The auditors of Ada Logics were:
Name Title Email
Adam Korczynski Security Engineer Adam@adalogics.com
David Korczynski Security Researcher David@adalogics.com
The maintainers of Jackson-core and Jackson-databind that were involved were:
Name Title Email
Tatu Saloranta Jackson maintainer Tatu@fasterxml.com
The following facilitators of OSTIF were engaged in the audit:
Name Title Email
Derek Zimmer Executive Director, OSTIF Derek@ostif.org
Amir Montazery Managing Director, OSTIF Amir@ostif.org
Project Timeline
Events and milestones of the audit.
August 15 2022 Kick-off meeting
September 6 2022 Status meeting #1
September 18 2022 Status meeting #2
September 31 2022 CVEs applied for for issue ADA-Jackson-10 and
ADA-Jackson-11
October 2 2022 CVEs assigned by MITRE
1st November 2022 The audit report is published
4
Audit scope
The following assets were in scope of the audit.
Jackson-core
Repository https://github.com/FasterXML/jackson-core
Language Java
Jackson-databind
Repository https://github.com/FasterXML/jackson-databind
Language Java
5
Initial assessment
As part of the audit, Ada Logics made an initial assessment of the existing security efforts of
Jackson-core and Jackson-databind. The two projects in scope were found to have a strong
security posture in place. Much work around the security of the projects had been carried out
by maintainers and contributors who visibly had been auditing the projects ad hoc in recent
years. Besides an XXE vulnerability1, most of the previous findings were related to
deserialization attacks leading to remote code execution or SSRF attacks. As of ultimo
October 2022, 70 reviewed advisories are registered for Jackson-databind of which the vast
majority are related to deserialization attacks2. As such, the vulnerable code being
exploitable in deserialization attacks via Jackson-databind has been in other classes not
related to Jackson-core and Jackson-databind. Dozens of CVE’s assigned to
Jackson-databind over the last years have been due to vulnerable code in other projects that
could be triggered via deserialization into these classes. At the time of the audit,
deserialization attacks were deemed out of scope, because so much effort had been
dedicated to them in the past few years.
From our point of view, Jackson-core and Jackson-databind are secure projects with positive
security habits in place. Few security issues had been found in the implementation of data
parsing and databinding, and most found security issues had come from insecure classes.
One area the projects were lacking was fuzzing. Parsing and data binding functionality is
especially well suited to test with fuzzing due to the complexity involved. Two areas where
fuzzing could be improved was test coverage and CI integration.
As part of the initial assessment, Ada Logics also perused the documentation of
Jackson-core and Jackson-databind and found that a great deal of effort had been put into
documenting usage, releases and security of the project. For example, a blog post had been
released to cover deserialization vulnerabilities in depth3, and well-defined policy on the
criteria for assigning CVEs to polymorphic deserialization4.
The auditors also found that both projects had plenty of examples on common usage as well
as well-defined Wikis describing optionals features. This proved tremendously helpful during
the audit, and we believe the investment is worthwhile for users and auditors; A well-defined
documentation is a contributing factor to improved security work in that it allows auditors
clear guidelines to get started with reviewing the project.
1https://github.com/advisories/GHSA-288c-cq4h-88gq
2
https://github.com/advisories?page=1&query=type%3Areviewed+ecosystem%3Amaven+jackson-data
bind
3
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0
d6e8062
4https://github.com/FasterXML/jackson/wiki/Jackson-Polymorphic-Deserialization-CVE-Criteria
6
Fuzzing continuously with OSS-Fuzz
Fuzzing is a vital component when ensuring the security of software. A goal of this security
audit was to contribute to Jackson-core and Jackson-databinds testing infrastructure by
improving their fuzzing suites. A big part of the engagement was dedicated to this part which
resulted in several found issues. When improving the fuzz testing of a software project, it is
critical to do it in such a manner that the fuzzers will run continuously - even after the initial
work of writing the fuzzers. To do this, the work done on fuzzing Jackson-core and
Jackson-databind in this audit evolved around OSS-Fuzz. OSS-Fuzz is an open source
service that helps assist in this context by handling the infrastructure of running fuzzers and
reporting issues for important open source projects. Jackson-core and Jackson-databind
were both integrated into OSS-Fuzz prior to this engagement start. However, there was only
a single fuzzer implemented for each project and the goal was, therefore, to expand the
fuzzing suite for each project. A key benefit from integrating the fuzzers by way of OSS-Fuzz
is that the fuzzers run continuously, both during and after the audit.
Fuzzing is particularly useful for data processing and parsing which makes Jackson-core
and Jackson-databind optimal projects to fuzz. The fuzzers found several issues of varying
nature: Some crashes revealed lack of bounds checks across many similar class methods in
both Jackson-core and Jackson-databind. ADA-Jackson-1, ADA-Jackson-2, ADA-Jackson-3,
ADA-Jackson-4 are examples of such cases where similar methods had similar lack of
sufficient data validation. Many crashes were reported for each of these four issues, and in
the report they are presented based on their root cause.
The issues ADA-Jackson-9, ADA-Jackson-10, ADA-Jackson-11 a