Executive brief
Alibaba Fastjson, a widely used Java library for processing data, contains a critical security flaw that allows attackers to execute unauthorized commands on a server. By sending a specially crafted data file, an attacker can trick the system into connecting to a malicious external server and running harmful code. This vulnerability has been actively exploited in the wild to compromise systems, steal sensitive data, and install persistent backdoors.
Technical details
Fastjson before 1.2.48 mishandles the 'autoType' deserialization feature. When a JSON document contains an '@type' key specifying a Java class, the library may invoke public methods of that class during parsing. An attacker can exploit this by providing a class name (such as java.lang.Class) to bypass existing whitelists and subsequently trigger a JNDI injection (e.g., via JdbcRowSetImpl) using a malicious RMI or LDAP URL. This vulnerability is an incomplete fix for CVE-2017-18349 and was later bypassed by CVE-2022-25845. It requires no authentication and can be exploited over the network, leading to full system compromise. The flaw has been observed in active exploitation by botnets like Androxgh0st.
Affected products
- Alibaba Fastjson before 1.2.48
Timeline
- 2018-03-21: patched: Version 1.2.48 released to address the issue.
- 2023: exploited: Exploitation in the wild began as early as 2023.
- 2026-01-09: advisory: CVE-2025-70974 published.
References
- https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955
- https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48
- https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce
- https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger
- https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238
- https://www.freebuf.com/vuls/208339.html
- https://www.seebug.org/vuldb/ssvid-98020