run2_jackson-empty-key-vulnerability

Jackson Empty Key ("") Vulnerability

The vulnerability (e.g., CVE-2021-25646 in Apache Druid) occurs when Jackson's @JacksonInject is used to provide sensitive configuration objects, but the deserialization process allows these objects to be overridden by malicious JSON input.

How it works

1. Unnamed Injected Parameters: If a constructor parameter is marked with @JacksonInject but lacks a @JsonProperty name, Jackson may default to matching it against certain JSON keys, including the empty string key "".
2. Override Behavior: By default, Jackson might allow the JSON input to populate the fields of an injected object if a match is found.
3. Security Bypass: In Druid, JavaScriptConfig is injected to determine if JavaScript is enabled. An attacker can provide "": {"enabled": true} in the JSON, which Jackson uses to override the server-side JavaScriptConfig object, thus enabling JavaScript execution for that specific request even if it's globally disabled.

The Fix: useInput = OptBoolean.FALSE

The robust fix is to explicitly tell Jackson NOT to use any JSON input for the injected parameter.

@JsonCreator
public MyObject(
    @JsonProperty("someField") String someField,
    @JacksonInject(useInput = OptBoolean.FALSE) MyConfig config
)

Setting useInput = OptBoolean.FALSE ensures that the config object is ONLY sourced from the InjectableValues (server configuration) and never from the JSON payload.