FastJson remote code execution flaw targets Spring Boot applications in US and Canada

Summary

A critical remote code execution (RCE) vulnerability has been identified in the FastJson open-source Java library, affecting versions 1.2.68 through 1.2.83. The flaw allows attackers to execute arbitrary code on a target server without requiring user interaction, elevated privileges, or third-party gadget chains.

Active exploitation is currently underway. While attacks are primarily focused on US-based organizations, researchers have observed activity targeting sectors including Financial Services, Healthcare, Computing, and Retail in Singapore and Canada. The vulnerability is particularly dangerous because it works under the library's stock default configuration.

Technical details

The flaw resides in FastJson's type-resolution logic. Specifically, the library performs attacker-controlled resource lookups before enforcing AutoType restrictions. This creates a path for remote code execution when the library processes malicious @type instructions.

The vulnerability is highly specific to certain deployment environments. It requires the target to be running as a Spring Boot executable fat-jar (launched via java -jar xxx.jar). In these scenarios, researchers have successfully reproduced full RCE by triggering jar:http methods on JDK 8 environments.

Crucially, standard mitigation attempts-such as specifying a target class during deserialization (e.g., JSON.parseObject(body, SomeDto.class))-do not prevent the attack. Attackers can simply nest malicious payloads within Object or Map typed fields of the specified Data Transfer Object (DTO).

Affected products and fixed versions

The vulnerability impacts the 1.x branch of FastJson. Because the 1.x series is no longer actively maintained, a formal security patch for these specific versions is not expected.

Defender guidance

Because the 1.x branch is unmaintained, migration is the only permanent fix. If your environment relies on these versions, take the following actions:

Immediate Mitigations If you cannot migrate immediately, enable SafeMode to disable the vulnerable type-resolution path. You can do this through three methods:

• Code level: ParserConfig.getGlobalInstance().setSafeMode(true)
• JVM startup parameter: -Dfastjson.parser.safeMode=true
• Configuration file: fastjson.parser.safeMode=true

Long-term Remediation Migrate all dependencies from FastJson 1.x to FastJson 2.x. The newer architecture eliminates the root cause by using an allowlist-first model and removing resource probing during type resolution.

Detection

Security teams can monitor for exploitation attempts by looking for specific payload signatures in POST and JSON requests at the network perimeter.

A working proof-of-concept is published at https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83.