Unpatched Fastjson Vulnerability Exploited in Attacks 未修补的Fastjson漏洞在攻击中被利用

TL;DR

• A critical remote code execution (RCE) vulnerability, CVE-2026-16723 (CVSS 9), has been actively exploited in Fastjson versions 1.2.68–1.2.83, impacting Spring Boot executable fat-jar deployments.
• The flaw allows unauthenticated attackers to execute arbitrary code via crafted JSON payloads with malicious @type values, bypassing AutoType protections without requiring gadgets or user interaction.
• No official patch exists for affected 1.x versions; organizations are advised to migrate to Fastjson 2.x or apply mitigations like enabling SafeMode and blocking specific request patterns.
• Observed attacks originate from browser impersonators (~70%) and Ruby/Go tools (~30%), targeting sectors including finance, healthcare, retail, and computing across the US, Singapore, and Canada.

Why It Matters

This vulnerability poses a severe risk to Java-based enterprise applications relying on Fastjson, especially those using default configurations in Spring Boot environments. Its exploitability without authentication or external dependencies makes it particularly dangerous for exposed services, demanding immediate remediation to prevent full server compromise.

Technical Details

• Vulnerability Scope: Affects Fastjson 1.2.68 through 1.2.83 (last 1.x release); versions 2.x are unaffected. Exploitation occurs in Spring Boot fat-jar deployments under default settings.
• Exploit Mechanism: Attackers craft JSON payloads containing a malicious @type field that triggers resource lookups during deserialization. Fastjson 1.x treats @JSONType annotations as trust signals, allowing bypass of AutoType restrictions even when disabled.
• Impact: Successful exploitation enables arbitrary code execution on target servers lacking SafeMode, threatening confidentiality, integrity, and availability. No authentication or user interaction is required.
• Mitigation Options: Migrate to Fastjson 2.x; if impossible, enable SafeMode, block POST/JSON requests with specific strings (e.g., @type, com.alibaba.fastjson.simple.Simple), or use patched builds removing vulnerable AutoType code.
• Threat Landscape: Active exploitation observed globally, primarily via browser impersonators and custom scripts in Ruby/Go, targeting diverse industries including financial services, healthcare, and retail.

Industry Insight

Organizations must prioritize inventory scans for Fastjson 1.x usage in production systems, especially within Spring Boot microservices, given the high likelihood of exposure. Security teams should treat this as a zero-day-like threat due to active exploitation and implement network-level filtering rules to block suspicious JSON payloads while planning rapid migration to Fastjson 2.x. Additionally, supply chain audits should include third-party libraries with similar serialization risks to prevent analogous vulnerabilities.

TL;DR

• Fastjson 1.2.68至1.2.83版本存在严重远程代码执行漏洞（CVE-2026-16723），CVSS评分9.0，无需认证即可利用。
• 攻击者可通过构造恶意JSON文件中的@type字段触发资源查找绕过机制，实现任意代码执行。
• 该漏洞在默认配置下可被利用，不依赖AutoType开启或外部gadget库，影响广泛且危害极大。
• 目前无官方补丁，建议迁移至Fastjson 2.x或启用SafeMode、过滤特定请求作为临时缓解措施。
• 已观察到针对金融、医疗、零售等多行业的实际攻击活动，来源主要为浏览器模拟工具及Ruby/Go编写的脚本。

为什么值得看

本文揭示了一个高危开源组件漏洞的实战化利用场景，对Java后端开发者和安全团队具有直接警示意义：即使未启用高风险特性（如AutoType），默认配置仍存在致命缺陷。同时反映了当前供应链攻击中“零交互、无认证”类漏洞的高频爆发趋势，亟需建立更严格的第三方库生命周期管理与应急响应机制。

技术解析

• 漏洞核心在于Fastjson 1.x版本在处理JSON反序列化时，将@JSONType注解视为可信信号，结合攻击者控制的资源查找路径，绕过了原本用于限制反序列化的安全边界。
• 受影响范围为所有以Spring Boot fat-jar形式部署的应用程序，这是企业级Java应用最常见的打包方式，导致潜在暴露面极广。
• 攻击载荷通过精心构造的JSON字符串注入恶意@type值，诱导库加载外部类并执行任意方法调用，整个过程无需用户交互或身份验证。
• Imperva分析指出约30%的攻击流量来自Ruby和Go编写的自动化扫描器，表明该漏洞已被快速整合进主流渗透工具链。
• SafeMode模式虽可提供部分防护，但并非完全可靠；彻底解决方案是升级至Fastjson 2.x架构，其重构了反序列化引擎从根本上消除此类风险。

行业启示

• 开源组件安全管理应从“被动打补丁”转向“主动淘汰旧版本”，尤其对于已停止维护的版本（如Fastjson 1.x最后一版1.2.83）必须强制替换。
• 在DevSecOps流程中应集成实时漏洞监测与依赖项健康度评估，避免因忽视中间件更新而引入不可控攻击入口。
• 面对此类无需认证的远程执行漏洞，组织应立即开展全网资产扫描，优先修复对外暴露的服务节点，并考虑在网络层实施WAF规则阻断含@type特征的异常请求。