| name | run2_jackson-empty-key-vulnerability |
| description | Detailed explanation of the Jackson empty key ("") vulnerability and how it bypasses @JacksonInject security. |
Jackson Empty Key ("") Vulnerability
The vulnerability (e.g., CVE-2021-25646 in Apache Druid) occurs when Jackson's @JacksonInject is used to provide sensitive configuration objects, but the deserialization process allows these objects to be overridden by malicious JSON input.
How it works
- Unnamed Injected Parameters: If a constructor parameter is marked with
@JacksonInject but lacks a @JsonProperty name, Jackson may default to matching it against certain JSON keys, including the empty string key "".
- Override Behavior: By default, Jackson might allow the JSON input to populate the fields of an injected object if a match is found.
- Security Bypass: In Druid,
JavaScriptConfig is injected to determine if JavaScript is enabled. An attacker can provide "": {"enabled": true} in the JSON, which Jackson uses to override the server-side JavaScriptConfig object, thus enabling JavaScript execution for that specific request even if it's globally disabled.
The Fix: useInput = OptBoolean.FALSE
The robust fix is to explicitly tell Jackson NOT to use any JSON input for the injected parameter.
@JsonCreator
public MyObject(
@JsonProperty("someField") String someField,
@JacksonInject(useInput = OptBoolean.FALSE) MyConfig config
)
Setting useInput = OptBoolean.FALSE ensures that the config object is ONLY sourced from the InjectableValues (server configuration) and never from the JSON payload.
