FASTJSON Includes Functionality from Untrusted Control Sphere

1. Executive summary

Fastjson before 1.2.48 mishandles its autoType feature: when a JSON document contains an @type key whose value names a Java class, the library may invoke public methods of that class, and depending on their behaviour this can reach JNDI injection with an attacker-supplied payload carried elsewhere in the same document. The flaw is tracked as CVE-2017-18349 at CVSS 9.8 CRITICAL (CWE-20, improper input validation), with EPSS 39%, and it is not in CISA KEV. A later bypass of the same autoType handling is tracked separately as CVE-2022-25845 at CVSS 8.1 HIGH (CWE-502, deserialization of untrusted data), EPSS 19%, also not in CISA KEV. The advisory states the issue was exploited in the wild from 2023 through 2025, which puts any EMEA financial services estate still running Fastjson below 1.2.48 in scope for active exploitation rather than theoretical risk.

2. Regulatory framing

No DORA incident-reporting article is engaged on the facts available: the sources describe a vulnerability and its exploitation history, not an incident at a named institution. If a client confirms exploitation against its own systems, DORA Art. 17, Art. 18 and Art. 19 and NIS2 Art. 23 become relevant at that point.

3. Technical analysis & attack chain

Confirmed steps, from the advisory text:

1. An application passes attacker-influenced JSON to Fastjson before 1.2.48 for parsing.
2. The JSON document contains an @type key whose value is the name of a Java class.
3. Fastjson's autoType handling resolves that class name and may call certain public methods of the named class.
4. Depending on what those methods do, the call reaches JNDI injection, with the attacker-supplied payload located elsewhere in the same JSON document.

The advisory does not name the specific classes, method names, or JNDI lookup strings used, so the exact gadget chain cannot be reproduced from this source. What is confirmed is the mechanism: autoType class resolution plus a method invocation that reaches a JNDI lookup, with the lookup target supplied in the same document.

Two related identifiers matter for triage. CVE-2017-18349 is the original autoType input-validation flaw, and the advisory states this issue exists because of an incomplete fix for it. CVE-2022-25845 covers a later bypass of the same handling. An estate that patched to a version addressing CVE-2017-18349 but stopped below 1.2.48 remains exposed to this issue and to the later bypass.

The advisory states the flaw was exploited in the wild in 2023 through 2025. It gives no actor name, no campaign name, no victim sector, and no tooling. There is no attribution to assess, and none should be inferred.

A classification discrepancy is worth recording. The verified reference data records CVE-2017-18349 as CWE-20 (improper input validation), while the advisory's own title frames the issue as "functionality from untrusted control sphere." Both describe the same defect: the library accepts a class name from untrusted input and acts on it. Use CWE-20 for tracking and control mapping.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Java application and service that embeds Fastjson. Check the dependency manifest and the deployed artefact, not just the build file, since Fastjson is frequently pulled in transitively. Record the resolved version for each.
• For any instance below 1.2.48, treat it as exposed. Where the application accepts JSON from an untrusted or semi-trusted source, disable autoType if the deployment allows it, or place the service behind input filtering that rejects @type keys in inbound JSON until the library is upgraded.
• Search application and WAF logs for JSON bodies containing @type and for JNDI lookup patterns (ldap://, rmi://, dns://) in request bodies. Any hit on a production service is a potential exploitation attempt and should be escalated as an incident.

P2 (within 72 hours)

• Upgrade Fastjson to 1.2.48 or later. Where a later release is available, prefer it, because CVE-2022-25845 covers a bypass of the fix for the earlier issue and the advisory does not state which release closes that bypass.
• Where the library is shipped inside a vendor product and cannot be upgraded directly, raise it with the vendor under the contract terms covering patching timelines, and apply compensating input filtering in the interim.
• Restrict outbound network access from application servers that parse untrusted JSON. JNDI injection depends on the application reaching an attacker-controlled lookup endpoint; egress filtering to known destinations removes the delivery path even when the library is unpatched.

P3 (within 7 days)

• Add Fastjson version checks to the dependency scanning pipeline so that any reintroduction below 1.2.48 fails the build.
• Review whether any service needs to deserialize arbitrary class names at all. Where it does not, disable autoType permanently rather than relying on version floors.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe the vulnerability mechanism and its exploitation history but provide no hashes, domains, IP addresses, file paths, or command lines. The behavioural indicators below are derived from the mechanism described in the advisory and are detection guidance, not observed artefacts.

Behavioural indicators

6. Detection

The sources give no file hashes, mutexes, filenames, or command lines. The one artefact specific to this threat is the @type key that drives autoType resolution, which is a genuine property of the malicious input rather than a vendor headline. The Sigma rule below keys on that string in HTTP request bodies; tune the field mapping to your logging pipeline before deployment.

title: Fastjson autoType @type Key in Inbound JSON Request Body
id: 7c1f4a92-3b6e-4d18-9a05-2e8f6b1d4c73
status: experimental
description: Detects the @type key in inbound JSON request bodies, the trigger for Fastjson autoType class resolution described in GHSA-jm7w-5684-pvh8. Tune field names to your proxy or application logging schema.
author: Adverse Trace
date: 2026-10-05
references:

  - https://github.com/advisories/GHSA-jm7w-5684-pvh8
logsource:
  category: webserver
detection:
  selection_type_key:

    - '@type'
  selection_jndi:

    - 'ldap://'
    - 'rmi://'
    - 'dns://'
  condition: selection_type_key and selection_jndi
fields:

  - cs-uri
  - cs-method
  - c-ip
falsepositives:

  - Legitimate applications that use @type in JSON payloads without reaching a JNDI lookup
level: medium

CVE assessment

2 referenced CVEs — 1 critical (CVSS ≥ 9.0)

7. Sources

• GitHub Advisory Database, "FASTJSON Includes Functionality from Untrusted Control Sphere" (GHSA-jm7w-5684-pvh8), published 2026-01-09, updated 2026-10-05. https://github.com/advisories/GHSA-jm7w-5684-pvh8
• National Vulnerability Database, CVE-2017-18349, referenced in the advisory above.
• National Vulnerability Database, CVE-2022-25845, referenced in the advisory above.

8. Adverse Trace position

CVE-2017-18349 is CVSS 9.8 CRITICAL with EPSS 39% and is not in CISA KEV; CVE-2022-25845 is CVSS 8.1 HIGH with EPSS 19% and is also not in CISA KEV. The advisory's statement that the flaw was exploited in the wild from 2023 through 2025 raises the practical priority above what the KEV absence alone would suggest, but the exploitation claim rests on a single source, the GitHub Advisory Database entry, and no actor, campaign, or victim detail is given; treat the attribution as unconfirmed and verify before acting on it. The exposure is concentrated in Java estates that embed Fastjson below 1.2.48, particularly services that parse JSON from untrusted sources, and the fix is a version upgrade rather than a configuration change. Adverse Trace will track further releases that close the CVE-2022-25845 bypass, and will reissue this advisory if a named actor or a corroborating vendor report emerges. Clients should return their Fastjson inventory and resolved versions within 72 hours so we can confirm scope.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.