alibaba/fastjson · Security
Improper Input Validation in alilibaba:fastjson
- GHSA ID
- GHSA-xjrr-xv9m-4pw5
- CVE ID
- CVE-2017-18349
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
CWEs
- CWE-20 · Improper Input Validation
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-18349 ↗
- https://github.com/pippo-java/pippo/issues/466 ↗
- https://fortiguard.com/encyclopedia/ips/44059 ↗
- https://github.com/advisories/GHSA-xjrr-xv9m-4pw5 ↗
- https://github.com/alibaba/fastjson/wiki/security_update_20170315 ↗
- https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2 ↗