Shulou(Shulou.com)05/31 Report--

This article is about how to achieve Fastjson loophole analysis, the editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

Introduction to 0x01

Fastjson is Alibaba's open source JSON parsing library, which can parse strings in JSON format, support serialization of JavaBean into JSON strings, and deserialize from JSON strings to JavaBean.

FastJson has the following characteristics:

(1) it can support serialization of java bean into JSON strings and deserialization of JSON strings into Java bean.

(2) as the name implies, the speed of FastJson operating JSON is very fast.

(3) there is no dependency of other packages.

(4) it is convenient to use.

Introduction of 0x02 vulnerabilities

Fastjson provides autotype function, which allows users to specify the deserialized type through "@ type" in deserialized data. When Fastjson self-defined deserialization mechanism calls the setter method and part of the getter method in the specified class, then when the component turns on the autotype function and deserializes the untrusted data, the attacker can construct the data to make the code execution process of the target application enter the specific setter or getter method of a particular class. If the specified method of the specified class has logic that can be maliciously exploited (commonly referred to as "Gadget"), it can cause some serious security problems. And in Fastjson 1.2.47 and below, the use of its cache mechanism can achieve the bypass of the unopened autotype function.

0x03 affects version

Fastjson

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.