Alibaba Fastjson (versions 1.2.68 through 1.2.83)
Fastjson is an open-source Java library maintained by Alibaba that parses and generates JSON (a common data exchange format), used extensively in enterprise web services and APIs.
Root Cause
Fastjson's type-resolution path trusts an attacker-supplied @type value and converts it into a class-resource lookup. When running inside a Spring Boot fat-JAR, this lookup can traverse nested JAR paths, fetch attacker-controlled bytecode from a remote location, and then treat an @JSONType annotation in that retrieved resource as a verification signal. Because that annotation is treated as evidence the class is trustworthy, Fastjson loads and executes the class. The developer failure here is allowing attacker-controlled input to influence which code gets loaded and trusted at runtime — without any independent validation.
Attack Vector
An attacker identifies a network-reachable endpoint that passes user-supplied JSON to JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class). They submit a payload embedding a crafted @type value pointing to a nested JAR path they control. Fastjson follows that path, retrieves the attacker's bytecode, reads the @JSONType annotation as a trust signal, and loads the class — executing the attacker's code with the full privileges of the Java process. No login, no existing access, and no classpath manipulation required.
Detection Notes
- Look for outbound connections from your Java application process to unexpected external hosts, particularly fetching
.jarfiles. - Monitor application logs for
@typevalues referencing unusual class names, nested JAR paths, or/proc/self/fdreferences. - Watch for unexpected child processes spawned by your Java application, or new files appearing in application directories without a deployment event.
Recommended Actions
- Inventory all Fastjson dependencies, including transitive ones pulled in by other libraries, and confirm whether versions 1.2.68–1.2.83 are present.
- Apply the immediate mitigation: add
-Dfastjson.parser.safeMode=trueto your JVM startup flags, or switch to thecom.alibaba:fastjson:1.2.83_noneautotypebuild. - Begin planning migration to Fastjson2, which does not share this type-resolution path and is Alibaba's stated long-term fix.