-
Notifications
You must be signed in to change notification settings - Fork 574
Security Advisory: Remote Code Execution in fastjson 1.2.68–1.2.83
Date / 发布日期：2026-07-21 Severity / 严重等级：🔴 Critical / 严重 Affected / 影响版本：fastjson 1.2.68 – 1.2.83 (including 1.2.83, the last 1.x release / 含 1.2.83，即 1.x 最后一个版本) Not affected / 不影响：All fastjson2 versions / fastjson2 所有版本
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
The only deployment prerequisite is that the target runs as a Spring Boot executable fat-jar (i.e., launched via java -jar xxx.jar). This is the most common Spring Boot deployment model.
Verified end-to-end on Spring Boot 2.x / 3.x / 4.x and JDK 8 / 11 / 17 / 21.
| Condition | Detail |
|---|---|
| fastjson version | 1.2.68 – 1.2.83 |
| Configuration | AutoType OFF + SafeMode OFF (stock defaults) |
| Deployment | Spring Boot executable fat-jar |
| JDK | 8 / 11 / 17 / 21 verified |
| Spring Boot | 2.x / 3.x / 4.x verified |
| Entry points |
JSON.parse, JSON.parseObject(String), JSON.parseObject(String, Class) all reachable |
⚠️ Specifying a target class (e.g.,JSON.parseObject(body, SomeDto.class)) is not a mitigation — attackers can nest payloads inside Object/Map-typed fields of the DTO.
| Condition | Reason |
|---|---|
| All fastjson2 versions | Root cause architecturally eliminated |
| SafeMode = true | Rejects all @type before the vulnerable path is reached |
| noneautotype builds | Vulnerable code removed at compile time |
| Non-fat-jar deployments | plain java -jar, uber-jar, Tomcat/Jetty WAR do not meet the trigger condition |
| fastjson ≤ 1.2.60 | Vulnerable code path does not exist |
fastjson2 architecturally eliminates the root cause of this vulnerability:
-
No resource probing: The type resolution path contains no
getResourceAsStreamcall on user-controlled class names; class loading uses onlyClassLoader.loadClass()andClass.forName() -
No annotation-based trust bypass: The
@JSONTypeannotation is used solely for serialization configuration, not as a trust signal in type resolution -
Allowlist-first model: Types must match an allowlist or be explicitly approved by an
AutoTypeBeforeHandler; otherwise they are rejected with no secondary escape path -
autoType disabled by default:
SupportAutoTypeis off by default, deprecated, and carries a security warning
fastjson2 users need take no action regarding this vulnerability.
| Priority | Action | Detail |
|---|---|---|
| P0 | Enable SafeMode |
-Dfastjson.parser.safeMode=true, or ParserConfig.getGlobalInstance().setSafeMode(true), or set in fastjson.properties
|
| P0 | Or switch to a noneautotype build | Maven example: com.alibaba:fastjson:1.2.83_noneautotype
|
| P1 | Migrate to fastjson2 | Architecturally eliminates this vulnerability; safe under default configuration |
No action required for this vulnerability. General security practices:
- Do not explicitly enable
JSONReader.Feature.SupportAutoType(deprecated) - If autoType capability is genuinely needed, use
ContextAutoTypeBeforeHandlerwith a strict allowlist
We thank Kirill Firsov of FearsOff Cybersecurity for discovering and responsibly disclosing this vulnerability.
fastjson 1.2.68 至 1.2.83 存在一条远程代码执行（RCE）漏洞。该漏洞在 fastjson 的默认配置下即可触发——无需开启 AutoType，无需 classpath 上存在任何 gadget 类。
唯一的部署前置条件是目标运行在 Spring Boot 可执行 fat-jar 模式下（即通过 java -jar xxx.jar 启动）。该模式是 Spring Boot 应用最常见的部署方式。
已在 Spring Boot 2.x / 3.x / 4.x，JDK 8 / 11 / 17 / 21 上完成端到端验证。
| 条件 | 说明 |
|---|---|
| fastjson 版本 | 1.2.68 – 1.2.83 |
| 配置 | AutoType OFF + SafeMode OFF（即默认配置） |
| 部署方式 | Spring Boot 可执行 fat-jar |
| JDK | 8 / 11 / 17 / 21 均验证 |
| Spring Boot | 2.x / 3.x / 4.x 均验证 |
| 入口 |
JSON.parse、JSON.parseObject(String)、JSON.parseObject(String, Class) 均可达 |
⚠️ 指定目标 Class（如JSON.parseObject(body, SomeDto.class)）不是缓解措施——攻击者可通过 DTO 中 Object / Map 类型的字段嵌套 payload。
| 条件 | 原因 |
|---|---|
| fastjson2 所有版本 | 架构上已消除此漏洞根因 |
| SafeMode = true | 在漏洞触发路径之前即拒绝所有 @type
|
| noneautotype 版本 | 漏洞相关代码在编译期被移除 |
| 非 fat-jar 部署 | plain java -jar、uber-jar、Tomcat/Jetty WAR 部署不满足触发条件 |
| fastjson ≤ 1.2.60 | 不存在漏洞相关代码路径 |
fastjson2 从架构上消除了此漏洞的根因：
-
无资源探测：类型解析路径中不存在基于用户可控类名的
getResourceAsStream调用，类加载仅使用ClassLoader.loadClass()和Class.forName() -
无注解信任绕过：
@JSONType注解仅用于序列化配置，不作为类型解析的信任判据 -
白名单优先：类型必须匹配白名单或经
AutoTypeBeforeHandler显式批准，否则直接拒绝，无二次逃逸路径 -
autoType 默认关闭：
SupportAutoType默认不启用，且已标记@Deprecated并附有安全警告
fastjson2 用户无需针对此漏洞采取任何行动。
| 优先级 | 措施 | 说明 |
|---|---|---|
| P0 | 启用 SafeMode |
-Dfastjson.parser.safeMode=true，或 ParserConfig.getGlobalInstance().setSafeMode(true)，或在 fastjson.properties 中设置 |
| P0 | 或切换 noneautotype 版本 | Maven 坐标示例：com.alibaba:fastjson:1.2.83_noneautotype
|
| P1 | 迁移至 fastjson2 | 从架构上消除此漏洞，且默认配置即安全 |
无需针对此漏洞采取任何行动。一般性安全实践：
- 避免显式启用
JSONReader.Feature.SupportAutoType（已废弃） - 如确需 autoType 能力，使用
ContextAutoTypeBeforeHandler配置严格白名单
感谢 FearsOff Cybersecurity 的 Kirill Firsov 发现并负责任地披露了该漏洞。