Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
A critical Remote Code Execution (RCE) vulnerability, CVE-2026-16723, affects Fastjson 1.x versions 1.2.68 through 1.2.83, carrying a CVSS score of 9.0. The exploit leverages Spring Boot executable fat-JARs to fetch attacker-controlled bytecode via nested JAR paths, bypassing standard AutoType and SafeMode defaults without requiring classpath gadgets. Active in-the-wild exploitation has been confirmed by ThreatBook and Imperva, targeting sectors such as finance and healthcare primarily in the US
Analysis
TL;DR
- A critical Remote Code Execution (RCE) vulnerability, CVE-2026-16723, affects Fastjson 1.x versions 1.2.68 through 1.2.83, carrying a CVSS score of 9.0.
- The exploit leverages Spring Boot executable fat-JARs to fetch attacker-controlled bytecode via nested JAR paths, bypassing standard AutoType and SafeMode defaults without requiring classpath gadgets.
- Active in-the-wild exploitation has been confirmed by ThreatBook and Imperva, targeting sectors such as finance and healthcare primarily in the US.
- No patched version for Fastjson 1.x is currently available; Alibaba recommends enabling SafeMode or migrating to Fastjson2 as immediate and long-term mitigations.
Why It Matters
This vulnerability is significant because it allows unauthenticated code execution in widely used Java applications, specifically those leveraging Spring Boot fat-JARs, which are common in enterprise microservices architectures. The fact that the exploit works without enabling AutoType or using external gadgets makes it particularly dangerous and difficult to detect using traditional security controls. Immediate action is required for organizations relying on affected Fastjson versions to prevent potential system compromise.
Technical Details
- Vulnerability Scope: Affects Fastjson versions 1.2.68 to 1.2.83 when used within Spring Boot executable fat-JARs. Plain JARs, WAR files, and non-fat deployments are unaffected.
- Exploit Mechanism: Attackers control the
@typevalue in JSON input, triggering a class-resource lookup. In a fat-JAR environment, this allows fetching malicious bytecode from a crafted nested JAR path. The presence of an@JSONTypeannotation in the fetched resource acts as a trust signal, bypassing type checks. - Bypass Techniques: The chain does not require AutoType to be enabled or any classpath gadgets. It exploits the interaction between Fastjson's type resolution and the Spring Boot fat-JAR loader.
- Mitigation Strategies: Immediate mitigation involves setting
-Dfastjson.parser.safeMode=trueor using thecom.alibaba:fastjson:1.2.83_noneautotypeartifact. Long-term fix is migrating to Fastjson2, which uses a different resource-probing mechanism.
Industry Insight
- Dependency Auditing: Organizations must immediately inventory all direct and transitive dependencies for Fastjson 1.x, paying close attention to Spring Boot fat-JAR configurations.
- Monitoring for Anomalies: Security teams should monitor for suspicious
@typevalues in JSON payloads, unexpected outbound connections, and the creation of child processes or web shells, which may indicate active exploitation. - Migration Priority: Given the lack of a patch for the 1.x series, migrating to Fastjson2 should be prioritized as the definitive solution, while interim measures like SafeMode provide temporary protection.
Disclaimer: The above content is generated by AI and is for reference only.