| शीर्षक | Oinone Oinone <= 7.2.0 Fastjson Remote Code Execution |
|---|
| विवरण | Oinone AI Low-Code Development Framework is a 100% metadata-driven framework. This vulnerability is caused by a combination of a configuration flaw in the Oinone framework's underlying parser and GraphQL type conversion logic. In PamirsParserConfig.java, the system inherits Fastjson's ParserConfig and explicitly calls this.setAutoTypeSupport(true). This directly disables Fastjson's core security defense, allowing the instantiation of arbitrary classes via the @type identifier in JSON.
When Oinone processes GraphQL requests, if the backend defined parameter type is Map but the attacker provides a String, the system automatically calls JsonUtils.parseMap(value) for parsing. Attackers can leverage the appConfigQuery interface (which is on the authentication-free whitelist) to pass a malicious JSON string (e.g., containing the JdbcRowSetImpl class) via nested HashMap. When the parser processes nested objects, it instantiates the malicious class based on @type and calls its Setter methods, thereby triggering a JNDI connection to load and execute remote malicious bytecode in memory. |
|---|
| स्रोत | ⚠️ https://github.com/SourByte05/SourByte-Lab/issues/13 |
|---|
| उपयोगकर्ता | sourbyte (UID 94279) |
|---|
| सबमिशन | 22/04/2026 10:21 AM (1 महीना पहले) |
|---|
| संयम | 16/05/2026 12:30 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 364323 [Oinone Pamirs तक 7.2.0 appConfigQuery Interface PamirsParserConfig.java JsonUtils.parseMap अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|