Fastjson 1.2.68 to 1.2.83 hit by critical RCE flaw, PoC available

The article discusses a critical security issue affecting fastjson versions 1.2.68 through 1.2.83, identified as a Remote Code Execution (RCE) vulnerability disclosed by researcher Kirill Firsov. This flaw allows attackers to exploit class name probing to execute arbitrary code without needing typical defenses such as setting AutoType off or using blocklists.

It is significant because it can affect millions of instances that parse untrusted JSON, and it requires urgent attention due to the availability of public proof-of-concept (PoC) exploit code. Recommended mitigations include enabling SafeMode, migrating to fastjson2, and blocking outbound HTTP connections to prevent exploitation. The article notes varying outcomes based on JDK versions and emphasizes that no confirmed in-the-wild exploits have been reported yet.