[Security Advisory] Fastjson <=1.2.68 Remote Code Execution Vulnerability in All Versions

Vulnerability Background

On May 28, 2020, an industry security vendor published a risk advisory for the Fastjson remote code execution vulnerability. Severity: high.

Fastjson is Alibaba’s open-source JSON parsing library. It can parse JSON-format strings, serialize Java Beans into JSON strings, and deserialize from JSON strings into JavaBeans.

Fastjson has a remote code execution vulnerability; the restriction of the autotype switch can be bypassed, and a chained deserialization attacker can craft a deserialization exploit chain, ultimately achieving remote command execution. This vulnerability itself cannot bypass Fastjson’s blacklist restriction; it needs to be combined with a deserialization exploit chain not on the blacklist to complete the full exploitation.

The official 1.2.69 version has been released. It is recommended that users upgrade promptly, perform asset self-checks, and apply security hardening per the temporary fix suggestions to avoid hacker attacks.

Vulnerability Details

Fastjson is Alibaba’s open-source JSON parsing library. It can parse JSON-format strings, serialize Java Beans into JSON strings, and deserialize from JSON strings into JavaBeans.

Researchers at Tencent Security Xuanwu Lab discovered that the restriction of the autotype switch can be bypassed, and then certain classes that were originally non-deserializable but carry security risks can be deserialized in a chained manner.

The actual harm of the vulnerability depends on the gadgets; the classes used in the gadgets must not be on the blacklist. This vulnerability cannot bypass the blacklist restriction.

Risk Level

High

Vulnerability Risk

Remote code execution, obtaining server system privileges

Affected Versions

Fastjson: <= 1.2.68

Fix Suggestions

1. Upgrade to version 1.2.69 or above;

2. For Fastjson 1.2.68, enable SafeMode via the following parameter to defend against attacks: ParserConfig.getGlobalInstance().setSafeMode(true); (SafeMode fully disables autotype, ignoring the whitelist — please evaluate the impact on your business);

3. It is recommended to replace it with components such as Jackson-databind or Gson.

【Note】: It is recommended to back up your data before applying the patch to avoid accidents.

Vulnerability References

1. Official update advisory: https://github.com/alibaba/fastjson/releases

2. Similar issue reference: https://github.com/FasterXML/jackson-databind/issues/2620#