AI Security AI安全 1d ago Updated 1d ago 更新于 1天前 49

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Fastjson 1.x RCE漏洞在攻击中被利用且无补丁可用

A critical Remote Code Execution (RCE) vulnerability, CVE-2026-16723, affects Fastjson 1.x versions 1.2.68 through 1.2.83, carrying a CVSS score of 9.0. The exploit leverages Spring Boot executable fat-JARs to fetch attacker-controlled bytecode via nested JAR paths, bypassing standard AutoType and SafeMode defaults without requiring classpath gadgets. Active in-the-wild exploitation has been confirmed by ThreatBook and Imperva, targeting sectors such as finance and healthcare primarily in the US 阿里巴巴Fastjson 1.x库存在严重远程代码执行漏洞(CVE-2026-16723,CVSS 9.0),无需启用AutoType或依赖类路径Gadget即可利用。 攻击者可通过构造恶意JSON请求,利用Spring Boot可执行fat-JAR中的嵌套JAR路径加载恶意字节码,从而以Java进程权限执行任意代码。 截至7月25日,Alibaba尚未发布修复该漏洞的Fastjson 1.x补丁,建议受影响组织立即启用SafeMode或迁移至Fastjson2。 威胁情报显示该漏洞已在野外被利用,主要针对金融、医疗等行业,且攻击者使用浏览器伪装及Ruby/Go工具发起请求。 漏洞影响范围涵盖

75
Hot 热度
65
Quality 质量
70
Impact 影响力

Analysis 深度分析

TL;DR

  • A critical Remote Code Execution (RCE) vulnerability, CVE-2026-16723, affects Fastjson 1.x versions 1.2.68 through 1.2.83, carrying a CVSS score of 9.0.
  • The exploit leverages Spring Boot executable fat-JARs to fetch attacker-controlled bytecode via nested JAR paths, bypassing standard AutoType and SafeMode defaults without requiring classpath gadgets.
  • Active in-the-wild exploitation has been confirmed by ThreatBook and Imperva, targeting sectors such as finance and healthcare primarily in the US.
  • No patched version for Fastjson 1.x is currently available; Alibaba recommends enabling SafeMode or migrating to Fastjson2 as immediate and long-term mitigations.

Why It Matters

This vulnerability is significant because it allows unauthenticated code execution in widely used Java applications, specifically those leveraging Spring Boot fat-JARs, which are common in enterprise microservices architectures. The fact that the exploit works without enabling AutoType or using external gadgets makes it particularly dangerous and difficult to detect using traditional security controls. Immediate action is required for organizations relying on affected Fastjson versions to prevent potential system compromise.

Technical Details

  • Vulnerability Scope: Affects Fastjson versions 1.2.68 to 1.2.83 when used within Spring Boot executable fat-JARs. Plain JARs, WAR files, and non-fat deployments are unaffected.
  • Exploit Mechanism: Attackers control the @type value in JSON input, triggering a class-resource lookup. In a fat-JAR environment, this allows fetching malicious bytecode from a crafted nested JAR path. The presence of an @JSONType annotation in the fetched resource acts as a trust signal, bypassing type checks.
  • Bypass Techniques: The chain does not require AutoType to be enabled or any classpath gadgets. It exploits the interaction between Fastjson's type resolution and the Spring Boot fat-JAR loader.
  • Mitigation Strategies: Immediate mitigation involves setting -Dfastjson.parser.safeMode=true or using the com.alibaba:fastjson:1.2.83_noneautotype artifact. Long-term fix is migrating to Fastjson2, which uses a different resource-probing mechanism.

Industry Insight

  • Dependency Auditing: Organizations must immediately inventory all direct and transitive dependencies for Fastjson 1.x, paying close attention to Spring Boot fat-JAR configurations.
  • Monitoring for Anomalies: Security teams should monitor for suspicious @type values in JSON payloads, unexpected outbound connections, and the creation of child processes or web shells, which may indicate active exploitation.
  • Migration Priority: Given the lack of a patch for the 1.x series, migrating to Fastjson2 should be prioritized as the definitive solution, while interim measures like SafeMode provide temporary protection.

TL;DR

  • 阿里巴巴Fastjson 1.x库存在严重远程代码执行漏洞(CVE-2026-16723,CVSS 9.0),无需启用AutoType或依赖类路径Gadget即可利用。
  • 攻击者可通过构造恶意JSON请求,利用Spring Boot可执行fat-JAR中的嵌套JAR路径加载恶意字节码,从而以Java进程权限执行任意代码。
  • 截至7月25日,Alibaba尚未发布修复该漏洞的Fastjson 1.x补丁,建议受影响组织立即启用SafeMode或迁移至Fastjson2。
  • 威胁情报显示该漏洞已在野外被利用,主要针对金融、医疗等行业,且攻击者使用浏览器伪装及Ruby/Go工具发起请求。
  • 漏洞影响范围涵盖Fastjson 1.2.68至1.2.83版本,且依赖于特定的Spring Boot fat-JAR部署环境,普通WAR包不受影响。

为什么值得看

该漏洞揭示了Fastjson在复杂部署环境(如Spring Boot fat-JAR)下的深层架构缺陷,打破了以往对AutoType开关的依赖认知,对Java生态安全具有重大影响。对于依赖Fastjson的企业而言,由于官方迟迟未出补丁,亟需采取紧急缓解措施或迁移方案,以避免遭受远程代码执行攻击。

技术解析

  • 漏洞原理:攻击者控制的@type值被转化为类资源查找,在Spring Boot fat-JAR中,通过构造嵌套JAR路径获取恶意字节码。资源中的@JSONType注解被误认为信任信号,使恶意类通过类型检查并加载。
  • 利用条件:需使用Fastjson 1.2.68-1.2.83版本,运行在Spring Boot可执行fat-JAR中,且存在网络可达的JSON解析入口(如JSON.parse)。SafeMode默认关闭,但即使AutoType禁用且无classpath gadget也可利用。
  • JDK兼容性:验证覆盖Spring Boot 2.x/3.x/4.x及JDK 8/11/17/21。在新版JDK中还存在通过/proc/self/fd引用远程下载JAR的利用路径。
  • 缓解与修复:短期可通过启动参数-Dfastjson.parser.safeMode=true启用SafeMode,或使用com.alibaba:fastjson:1.2.83_noneautotype构建。长期建议迁移至不受此资源探测机制影响的Fastjson2。
  • 检测指标:检查系统中是否存在可疑的@type值、嵌套JAR URL、异常出站连接、子进程生成、文件变更或Webshell。

行业启示

  • 供应链与依赖管理风险:即使是最流行的开源库,其底层架构设计缺陷也可能在特定框架组合(如Spring Boot fat-JAR)下被触发,企业需定期审计间接依赖及其运行环境配置。
  • 应急响应滞后性:在官方补丁缺失的情况下,安全团队必须依赖临时缓解措施(如配置调整、WAF规则)和监控告警来降低风险,这要求具备快速响应和隔离能力。
  • 技术栈现代化必要性:旧版本库(如Fastjson 1.x)的安全维护往往滞后,且存在已知但未彻底解决的隐患,推动核心组件向更安全的新一代架构(如Fastjson2)迁移是长期安全战略的关键。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全