m-novotny
Featured
memguard-rs
A Rust library that provides secure memory handling primitives including zeroization on drop, memory locking, constant-time comparison, and compile-time guarded regions, with zero dependencies and no_std support.
fastjson-jsontype-rce-lab
This repository reconstructs and provides detection tools for a Fastjson 1.2.83 remote code execution chain that exploits the @JSONType annotation and the /proc/self/fd file descriptor technique, bypassing AutoType disable and DTO binding.
Stars
184
7-day growth
+31
Forks
88
Open issues
0
License
MIT
Last updated
2026-07-27
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It demonstrates a critical vulnerability (F105) in Fastjson 1.2.83 that works even with AutoType disabled and through a fixed DTO, and offers both reproducible labs and defensive scanning tools.
Who it is for
- Security researchers analyzing Fastjson vulnerabilities
- Java developers using Fastjson in production
- DevOps engineers securing Java applications
- Penetration testers evaluating attack surface
Use cases
- Reproducing the @JSONType remote-JAR/FD chain in a controlled lab environment
- Passively inspecting JSON request logs for exploitation patterns
- Static inventory of JAR artifacts for vulnerable Fastjson versions
- Active reachability probing to detect vulnerable endpoints without RCE
Strengths
- Includes both legacy JDK 8 and modern JDK 17 reproducible labs with clear documentation
- Provides four dependency-free Python scanning tools for passive, static, active, and payload generation
- Whole-project security review covering 2,041 callable rows across 193 Fastjson files
- Clear mitigation guidance including SafeMode and vendor-specific builds
Considerations
- Modern FD chain requires Linux with procfs and specific conditions; not universal across all JDKs or OS
- Labs are intended for authorized use only; legacy lab executes commands and must be isolated
- Active probe only confirms callback, not class loading or RCE
README quick start
Fastjson @JSONType remote-JAR/FD-chain lab and detection
This repository now preserves two distinct Fastjson research tracks:
modern-fd/is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and JDK 17. It uses the literal fixed-DTO sinkJSON.parseObject(body, BoundEnvelope.class)with AutoType disabled.- The original top-level Docker Compose lab preserves the earlier JDK 8 direct remote-class route. It is command-capable and should be treated as a legacy, isolated proof rather than the modern-JDK method.
scanner/contains passive request/log detection, static artifact inventory and a non-executing reachability probe.
The bug:
ParserConfig.checkAutoTypeprobes every@typevalue for the@JSONTypeannotation by doinggetResourceAsStream(typeName.replace('.','/') + ".class"). On modern Linux/JDK combinations, a remotejar:httpprobe can leave the JAR cached behind an open descriptor; laterjar:file:/proc/self/fd/Nprobes in the same body can reopen it under valid class names and initialize an annotated class. The exact 1.2.83 composition works with AutoType disabled and through a fixed DTO containingList. Binding alone is therefore not a mitigation. Full walk-through:docs/MECHANISM.md.
Security review findings
The companion whole-project review covered 2,041 callable/static-initializer rows across all 193 Fastjson 1.2.83 production Java files. The table below prioritizes the highest-impact results; it is not a claim that every Fastjson deployment is affected. This repository directly reproduces F105. The remaining entries summarize separately sealed source review and bounded lab evidence.
| Priority | Finding | Proven result | Important boundary |
|---|---|---|---|
| 1 | F105 — remote @JSONType bytecode execution | Attacker-supplied class initialization through compatible Spring Boot loaders, including the JDK 8 direct route and the Linux/JDK 17 retained-JAR /proc/self/fd/N continuation | Requires a parser-reachable @type carrier, compatible Boot/TCCL loader, egress, SafeMode/IgnoreAutoType off, and an exact attacker JAR. The modern fixed-DTO route additionally needs a generic value lane (the lab uses List), Linux pro |
Description
Docker lab + one-payload exploit + defensive scanner for the fastjson 1.2.66-1.2.83 @JSONType remote-class-load RCE (SSRF->defineClass under Spring Boot LaunchedURLClassLoader; autoType OFF; parseObject binding is not a mitigation)
Related repositories
Similar projects matched by category, topics, and programming language.
lopopolo
Featured
harness-engineering
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
slvDev
Featured
esp32-ai
A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.