ktg-mes Fastjson Deserialization Vulnerability

A deserialization vulnerability in ktg-mes has been identified, stemming from the use of a vulnerable version of fastjson that improperly handles unsafe input data. This issue is present in all commits prior to 2025-10-08.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, send a PUT request to the '/dev-api/tool/gen' endpoint with a payload that includes maliciously crafted JSON data. The 'params' field of the JSON payload should be constructed to exploit the deserialization flaw, such as by referencing an exception type that could lead to code execution. Include an 'Admin-Token' cookie and a Bearer token in the Authorization header to authenticate the request.