Maven · com.fasterxml.jackson.core:jackson-databind
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter.
POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.
git tag --contains)>= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport c3d56dd, #5968)>= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5967, e88cb17)Maintainer: minor. Reporter: HIGH. CWE-915.
Omkhar Arasaratnam (@omkhar) - finder.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.