{"repo":"dinosn/fastjson-jsontype-rce-lab","free":true,"listed":false,"github":"https://github.com/dinosn/fastjson-jsontype-rce-lab","clone":"git clone https://github.com/dinosn/fastjson-jsontype-rce-lab.git","description":"Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@JSONType(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.","language":"Python","stars":203,"topics":["appsec","deserialization","fastjson","jsontype","poc","rce","security","security-lab","spring-boot","ssrf"],"license":"MIT","category":"security-tools","readme_excerpt":"Fastjson @JSONType remote-JAR/FD-chain lab and detection This repository now preserves two distinct Fastjson research tracks: - modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and JDK 17. It uses the literal fixed-DTO sink JSON.parseObject(body, BoundEnvelope.class) with AutoType disabled. - The original top-level Docker Compose lab preserves the earlier JDK 8 direct remote-class route. It is command-capable and should be treated as a legacy, isolated proof rather than the modern-JDK method. - scanner/ contains passive request/log detection, static artifact inventory and a non-executing reachability probe. The bug: ParserConfig.checkAutoType probes every @type value for the @JSONType annotation by doing getResourceAsStream(typeName.replace('.','/') + \".class\") . On modern Linux/JDK combinations, a remote jar:http probe can leave the JAR cached behind an open descriptor; later jar:file:/proc/self/fd/N probes in the same body can reopen it under valid class names and initialize an annotated class. The exact 1.2.83 composition works with AutoType disabled and through a fixed DTO containing List . Binding alone is therefore not a mitigation. Full walk-through: docs/MECHANISM.md . Security review findings The companion whole-project review covered 2,041 callable/static-initializer rows across all 193 Fastjson 1.2.83 production Java files. The table below prioritiz","default_branch":null,"files":null,"tree":[],"storefront":"/r/dinosn","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/dinosn/fastjson-jsontype-rce-lab/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}