Fastjson up to 1.2.24 rmi:/ URL AjaxApplication.java parseObject dataSourceName input validation

Summaryinfo

A vulnerability classified as critical has been found in Fastjson up to 1.2.24. Affected by this vulnerability is the function parseObject of the file AjaxApplication.java of the component rmi:/ URL Handler. The manipulation of the argument dataSourceName as part of JSON Request leads to input validation. This vulnerability is listed as CVE-2017-18349. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Fastjson up to 1.2.24. It has been rated as critical. This issue affects the function parseObject of the file AjaxApplication.java of the component rmi:/ URL Handler. The manipulation of the argument dataSourceName as part of a JSON Request leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

The bug was discovered 06/08/2017. The weakness was presented 10/23/2018 (Website). The advisory is shared at fortiguard.com. The identification of this vulnerability is CVE-2017-18349 since 10/23/2018. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 502 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.2.25 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Fastjson

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion