jackson-security

Jackson Deserialization Security

Key Concept: Deserialization Timing

Jackson transforms JSON text into Java objects during a single readValue() call. This transformation is not a simple data copy—Jackson interprets JSON structure, resolves types, handles special keys, and instantiates objects all within this operation.

JSON String → [Jackson Processing] → Java Object
                    ↑
            Attack surface here

Once deserialization completes, the resulting Java object contains no trace of how it was constructed. Any special JSON structures, unusual keys, or type directives that influenced object creation are no longer visible.

Why Post-Deserialization Validation Is Insufficient

Consider the lifecycle of a typical JSON endpoint:

1. HTTP request arrives with JSON body
2. Framework deserializes JSON → Java object (Jackson runs here)
3. Your code receives the Java object
4. Your code validates the object
5. Your code processes the object

Validation at step 4 examines the result of deserialization, not the process. Any malicious behavior triggered during step 2 has already executed. The Java object you're validating may appear completely normal while the attack has already succeeded.

This creates a fundamental blind spot: attacks that exploit Jackson's parsing behavior—rather than the final object state—cannot be detected by examining the deserialized object.

The Empty Key ("") Attack Vector

What Is It?

JSON permits empty strings as object keys:

{
  "name": "legitimate",
  "": "injected value"
}

This is valid JSON per RFC 8259. Jackson parses it without error.

Why Does It Matter?

Some applications and frameworks assign special meaning to empty keys:

• Injection points: Certain Jackson configurations use "" to set values on the root object or trigger special handling
• Property override: Empty keys may interact unexpectedly with @JsonAnySetter or custom deserializers
• Framework behaviors: Some frameworks interpret "" as "apply to parent" or "default target"

The Visibility Problem

After deserialization, there is no standard way to know an empty key was present:

// Original JSON: {"name": "test", "": "malicious"}
MyObject obj = mapper.readValue(json, MyObject.class);
// obj.getName() returns "test"
// Where did "" go? Depends on configuration. You cannot tell from obj.

The attack's effectiveness depends on the specific Jackson configuration and target class—but the defender examining only the resulting object cannot determine whether "" was used.

Other Structural Attack Patterns

Polymorphic Type Handling

When Jackson is configured with @JsonTypeInfo, JSON can specify which class to instantiate:

{
  "@class": "com.attacker.MaliciousClass",
  "command": "rm -rf /"
}

Jackson will attempt to instantiate whatever class is named. If the classpath contains exploitable "gadget" classes, arbitrary code execution may occur during deserialization—before your code ever runs.

The resulting object might be the expected type (if the attack class is a subtype), or deserialization might succeed partially before the damage is done.

Duplicate Keys

JSON does not prohibit duplicate keys. Jackson's default behavior: last value wins.

{
  "role": "user",
  "role": "admin"
}

Jackson produces an object where role equals "admin".

If upstream validation (like a WAF or input filter) checks only the first occurrence while Jackson uses the last, the validation and processing see different values.

Nested Injection

Deeply nested structures can bypass depth-limited validation:

{
  "config": {
    "settings": {
      "internal": {
        "": "payload"
      }
    }
  }
}

Simple string checks might miss patterns buried in nested structures.