Recently, Fastjson officially released a security announcement, disclosing a Remote Code Execution Vulnerability. In Fastjson versions 1.2.68 to 1.2.83, a library-independent security vulnerability exists during deserialization. Exploitation requires no AutoType enabling and no classpath gadgets. Under default configuration, attackers can construct malicious JSON payloads to trigger arbitrary code execution.

Fastjson is an open-source, high-performance Java JSON library from Alibaba for converting Java objects and JSON data efficiently. If you are a Fastjson user, check your system and implement timely security hardening.

Reference:

https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83

important

(Severity: low, medium, important, and critical)

1.2.68 <= Fastjson 1.x <= 1.2.83

Fastjson 2.x

This vulnerability has been fixed in later official versions. If your service version falls into the affected range, upgrade it to a latest secure version.

https://github.com/alibaba/fastjson2/releases/

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.

Get more professional support at any time

Contact Us