249 matches found
CVE-2017-18349
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...
CVE-2017-18349
The CVE-2017-18349 entry describes Fastjson before 1.2.25 enabling remote code execution when used by Pippo 1.11.0 via a crafted JSON payload. The Nuclei template confirms the vulnerability is an insecure deserialization in FastjsonEngine where a crafted rmi:// URI in dataSourceName of an HTTP PO...
CVE-2017-18349
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...
Improper Input Validation
Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java...
vulhub
This is a Docker Compose file for a vulnerability environment. It is a collection of services and their configurations that can be used to test and demonstrate various vulnerabilities. The file is written in YAML format and defines the services, their ports, and their dependencies. The services...
In-depth understanding of the JAVA deserialization vulnerability-vulnerability warning-the black bar safety net
1.Java serialization and deserialization Java serialization refers to the Java object is converted to byte sequence of the process easy to save in memory, a file, a database, the ObjectOutputStream class's writeObjectmethod can be implemented serialized. Java deserialization refers to the sequenc...
fastjson remote code execution vulnerability technical analysis and protection solution-vulnerability warning-the black bar safety net
! 2017-year 3 December 15, fastjson official released a security Bulletin indicating fastjson in 1. 2. 24 and the prior version there is a remote code execution high-risk security vulnerabilities. An attacker can use this vulnerability to remotely execute malicious code to invade the server...
Remote Code Execution (RCE)
Fastjson is vulnerable to remote code execution RCE attacks. This is because it does not properly deserialize object arrays when parsing JSON objects. Note please upgrade to version 1.2.28 or higher because of compatibility issues, though it was fixed in 1.2.25...
