CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

39.24% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-20

Published

2018-10-23

Updated

2024-09-17

Proof-of-concept exploits (3)

• h0cksr/Fastjson--CVE-2017-18349-2★ · 2022-04-15
• Dungsocool/CVE-2017-183490★ · 2026-05-29
• N0tOd2y/PenForge1★ · 2026-09-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml

Security advisories

• https://fortiguard.com/encyclopedia/ips/44059
• alibaba/fastjson/wiki/security_update_20170315
• pippo-java/pippo/issues/466
• advisories/GHSA-xjrr-xv9m-4pw5

References

• CVE Record
• NVD entry

Related

• CVE-2014-3120
• CVE-2017-10271
• CVE-2017-11610
• CVE-2017-12635
• CVE-2017-5638
• CVE-2018-7600