Attackers can achieve remote code execution in Fastjson 1.x via Spring Boot fat-jars

Summary

A high-severity vulnerability has been disclosed in Alibaba's Fastjson library affecting versions 1.2.68 through 1.2.83. This flaw enables remote code execution (RCE) without requiring the AutoType setting to be enabled or a specific gadget present on the application's classpath.

The vulnerability is highly specific to deployment environments where the target runs as a Spring Boot executable fat-jar (launched via java -jar xxx.jar). This represents one of the most common deployment models for modern Java applications. Testing has confirmed the issue across Spring Boot 2.x, 3.x, and 4.x, as well as JDK versions 8, 11, 17, and 21.

Technical details

The vulnerability stems from how type resolution is handled within the legacy Fastjson 1.x architecture. Unlike newer iterations of the library, this flaw can be triggered using the stock default configuration.

Crucially, developers cannot mitigate this by specifying a target class during parsing. For example, calling JSON.parseObject(body, SomeDto.class) does not prevent an attack; an attacker can simply nest malicious payloads inside fields typed as Object or Map within that DTO.

The vulnerability is addressed architecturally in the fastjson2 library through several changes:

• Elimination of resource probing via getResourceAsStream on user-controlled names.
• Removal of annotation-based trust bypasses.
• An allowlist-first model where types must be explicitly approved.
• Disabling autoType by default and marking it as deprecated.

Affected products and fixed versions

Why this matters for defenders

This vulnerability bypasses common defensive assumptions regarding Fastjson security. Many teams believed that disabling AutoType or defining strict target classes would prevent RCE; however, this flaw functions regardless of those settings if the application is deployed as a Spring Boot fat-jar.

Because the attack vector relies on the standard deployment method for Spring Boot, the potential blast radius includes a vast number of enterprise Java applications.

Defender guidance

The primary defense against this vulnerability is to migrate from the legacy fastjson 1.x branch to fastjson2. The newer architecture eliminates the root causes present in the 1.x series.

If immediate migration is not possible, observe these constraints:

• Do not explicitly enable JSONReader.Feature.SupportAutoType.
• If autoType capability is required for your business logic, you must use a ContextAutoTypeBeforeHandler configured with a strict allowlist of approved classes.