Fastjson--CVE-2017-18349-

Fastjson--CVE-2017-18349-Cancel changes After setting the project as a Maven project, run note: using a higher version of JDK may fail, it is recommended to use JDK version 1.8.65 Just run the main function of FastjsondemoApplication.java TouchFile.java file import java.lang.Runtime; import...

CVE-2017-18349

Lab 6-CVE-2017-18349 I. SYSTEM ANALYSIS Attack Surface Identification Let's start with what is running in the environment. I list all active containers: docker ps The victim exposes only a single port:8090 Currently, I am not yet fully clear on the target. From the docker ps results, the system...

Exploit for Improper Input Validation in Alibaba Fastjson

Lab 6-CVE-2017-18349 I. SYSTEM ANALYSIS Attack S...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2017-18349

creationtimestamp| type| source ---|---|--- 2024-12-23 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-23 2024-12-27 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-12-27 2024-12-30 00:00:00+00:00| seen| The Shadowserver...

ro.pippo:pippo-demo-basic (0.4.2), ro.pippo:pippo-demo-controller (0.4.2) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.4.2)

ro.pippo:pippo-fastjson MAVEN version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.4.2 - ro.pippo:pippo-demo-controller 0.4.2 - ro.pippo:pippo-demo-crud 0.4.2 -...

ro.pippo:pippo-demo-basic (0.5.0), ro.pippo:pippo-demo-controller (0.5.0) +2 more potentially affected by CVE-2017-18349 via ro.pippo:pippo-fastjson (0.5.0)

ro.pippo:pippo-fastjson MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on ro.pippo:pippo-fastjson and may be impacted: - ro.pippo:pippo-demo-basic 0.5.0 - ro.pippo:pippo-demo-controller 0.5.0 - ro.pippo:pippo-demo-crud 0.5.0 -...

cc.openkit:open_kit (>=1.1.6, <=1.1.18), cn.51daxia:zzz-websocket (>=1.0, <=1.1) +1621 more potentially affected by CVE-2017-18349 via com.alibaba:fastjson (>=1.1.15, <=1.2.24)

com.alibaba:fastjson MAVEN version =1.1.15, =1.1.6, =1.0, =1.0.0, =1.0.0, =6.1.7, =6.2.08, =6.1.0, =6.1.7, =6.1.0, =6.1.0, =1.0.0, =6.1.0, =6.1.12c, =6.1.14a, =1.0.0, =6.0.01 and more Source cves: CVE-2017-18349 Source advisory: GHSA-XJRR-XV9M-4PW5...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...