Security researchers are warning that a critical flaw in Fastjson, Alibaba's widely used open-source library for handling JSON data in Java applications, lets unauthenticated attackers run their own code on affected servers. NSFOCUS CERT says a public proof-of-concept exists and that it has already seen exploitation in the wild.
What's affected
The bug carries a CVSS severity score of 9.8 out of 10 and affects Fastjson version 1.2.68 up to and including 1.2.83. The 2.x line of the library is not affected. Fastjson is one of the most common JSON parsers in the Java ecosystem, so the flaw potentially reaches a large number of web services and back-end applications that never think of the library as an exposed attack surface.
How the attack works
The problem lies in how Fastjson turns incoming JSON text back into Java objects, a process called deserialization. Fastjson has long shipped an "autoType" control meant to block dangerous object types, backed by allow and deny lists. According to NSFOCUS, a defect in the library's internal type-parsing logic lets an attacker craft malicious JSON that slips past those lists. What makes this flaw stand out is that it needs no third-party "gadget" classes present on the server, the helper classes that most deserialization exploits rely on. Removing that dependency makes the bug far easier to weaponize against a wide range of targets.
What you should do
Alibaba has not yet released a security fix for the 1.x branch, so NSFOCUS recommends migrating to Fastjson 2.x after testing for compatibility. If you cannot upgrade immediately, enable the library's safeMode, which disables autoType entirely regardless of the allow and deny lists. You can turn it on in code, through the JVM startup parameter -Dfastjson.parser.safeMode=true, or via a fastjson.properties file. As a stopgap, a web application firewall can be tuned to inspect request bodies for the @type key that these payloads abuse, taking care to cover both URL parameters and the body and to account for encoding tricks.
The alert echoes a run of actively exploited flaws that CISA and vendors have highlighted this month, including a SharePoint bug added to CISA's active-exploitation list. You can read NSFOCUS CERT's original advisory for detection and mitigation detail.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.