漏洞描述
fastjson是阿里巴巴的开源JSON解析库，它可以解析JSON格式的字符串，支持将JavaBean序列化为JSON字符串，也可以从JSON字符串反序列化到JavaBean，由于具有执行效率高的特点，应用范围广泛。利用该漏洞在autoType关闭的情况下仍然可以绕过黑白名单防御机制，造成远程命令执行漏洞。
Fastjson 1.2.68 远程代码执行漏洞
PoC代码
暂无相关漏洞推荐
- POC CVE-2025-1302: JSONPath Plus < 10.3.0 - Remote Code Execution
- fastjson-rce-all: Fastjson Deserialization RCE
- hikvision-center-fastjson-rce: 海康威视综合安防-运行管理中心-Fastjson-远程命令执行漏洞
- POC CVE-2017-18349: Fastjson Insecure Deserialization - Remote Code Execution
- POC CVE-2020-28429: geojson2kml - Command Injection
- POC landray-oa-datajson-rce: Landray OA Datajson RCE
- POC yunanbao-authservice-fastjson-rce: 云匣子 FastJson反序列化RCE漏洞
- POC config-json-exposure-fuzz: Exposed JSON Configuration Files
- POC config-json: Configuration File - Detect
- POC auth-json: Auth.json File - Disclosure
- POC azuredeploy-json: Azure Resource Manager Template - File Exposure
- POC composer-auth-json: Composer-auth Json File Disclosure
- POC credentials-json: Credentials File Disclosure