CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

38.97% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-20

Published

2018-10-23

Updated

2024-09-17

Proof-of-concept exploits (2)

• h0cksr/Fastjson--CVE-2017-18349-2★ · 2022-04-15
• Dungsocool/CVE-2017-18349

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2014-3120
• CVE-2017-10271
• CVE-2017-11610
• CVE-2017-12635
• CVE-2017-5638
• CVE-2018-7600