Deep Dive into Fastjson Deserialization Vulnerabilities: From Principles to Practical Defense

I. Core Principle of Fastjson Vulnerabilities: AutoType Mechanism Is the Root Cause

Fastjson’s deserialization vulnerabilities stem from flaws in the AutoType mechanism, originally designed for simplifying object restoration. Attackers exploit this to load malicious classes and trigger dangerous operations, resulting in Remote Code Execution (RCE).

Why This Matters

Ideal models assume trusted input, but real-world applications face malicious JSON payloads. Unpatched Fastjson vulnerabilities have repeatedly led to large-scale security incidents and server compromise, costing organizations significant resources in remediation and potential data breaches.

Key Insights

• CVE-2022-25845: A critical vulnerability allowing RCE through crafted JSON payloads.
• AutoType Mechanism: Designed for convenience, but creates a pathway for arbitrary code execution when misused.
• SafeMode: A crucial feature to completely disable the AutoType mechanism, offering a strong security measure.

Working Example

package org.example;
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.ParserConfig;

public class FastjsonDemo {
    public static void main(String[] args) {
        // Disable AutoType globally
        ParserConfig.getGlobalInstance().setAutoTypeSupport(false);

        String json = "{\"@type\":\"org.example.User\",\"age\":25,\"name\":\"Zhang San\"}";
        // Attempting to parse with AutoType disabled will now fail or return a safe object
        //User user = JSON.parseObject(json, User.class);
        //System.out.println(user);
    }
}

Practical Applications

• Financial Institutions: Protect sensitive transaction data by disabling AutoType and upgrading Fastjson.
• Pitfall: Relying on blacklists for security is ineffective, as attackers continuously discover bypass techniques.

References:

• https://dev.to/tiger_smith_9f421b9131db5/deep-dive-into-fastjson-deserialization-vulnerabilities-from-principles-to-practical-defense-2ka6