CVE-2022-25845 PoC — Deserialization of Untrusted Data

Source

https://github.com/hosch3n/FastjsonVulns

Associated Vulnerability

Title: Deserialization of Untrusted Data (CVE-2022-25845)
Description:The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Description

[fastjson 1.2.80] CVE-2022-25845 aspectj fileread & groovy remote classload

Readme

[Fastjson1.2.80漏洞复现](https://hosch3n.github.io/2022/09/01/Fastjson1-2-80%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →