POC Details: 1959b3212bc634f7cc6e48a51bb452bc7a4f6a34

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/vlife-fastjson-rce.yaml

Associated Vulnerability

Likely 0-day

Description

alibaba/fastjson v1.2.67 within the MyUsernamePasswordAuthenticationFilter for processing authentication requests. The /vlife/login endpoint directly deserializes the raw HTTP request body using JSON.parseObject() without enforcing type restrictions or enabling safe mode, allowing unauthenticated attackers to exploit known fastjson gadget chains for Remote Code Execution.

File Snapshot


 id: vlife-fastjson-rce

info:
  name: Vlife FastJSON - Remote Code Execution
  author: omarkurt
  se

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.