I familiarized myself with the vulnerability exploitation process of fastjson. The vulnerability principle of fastjson is not covered here. Although there are many explanations online, they are too basic and simple, and no one has written about it. I had to figure it out on my own.
Project Address#
GitHub - Lonely-night/fastjsonVul at 7f9d2d8ea1c27ae1f9c06076849ae76c25b6aff7
Exploitation Conditions#
- fastjson version: 1.2.76 <= fastjson < 1.2.83
- Requires groovy dependency
Reproduction Steps#
- Compile the attack module into attack-1.jar package.
- Execute the HTTP server in the directory where attack-1.jar package is located.
python -m SimpleHTTPServer 8433
- Run the proof of concept (poc).
Reopen the project using IntelliJ IDEA. Project path:
Switch JDK version to 1.8
Open the poc.java file, which contains the payload for vulnerability verification.
Right-click and run.
Successfully run the payload.
The article is rough, please forgive me.
Image source: https://wallhaven.cc/