Hackers Target US Firms in FastJson RCE Zero-Day Attacks

Active Exploitation of Unpatched FastJson Vulnerability

Threat actors are actively exploiting a remote code execution (RCE) zero-day vulnerability in Alibaba's FastJson, one of the most widely used open-source Java JSON parsing libraries. The attacks are targeting US enterprises and require no authentication and no user interaction, giving the vulnerability maximum exploitability characteristics.

FastJson is embedded in countless enterprise Java applications for high-performance JSON serialization and deserialization. Its widespread adoption across financial services, logistics, healthcare, and government applications makes this zero-day particularly high-impact.

Vulnerability Details

The flaw resides in FastJson's deserialization logic — the same attack surface responsible for previous high-severity FastJson vulnerabilities (CVE-2022-25845 and earlier). Attackers craft malicious JSON payloads that, when parsed by the vulnerable library, trigger arbitrary class instantiation and ultimately achieve full remote code execution on the target server.

How the Attack Works

1. Attacker identifies an internet-facing endpoint that parses JSON via FastJson
2. Attacker sends a crafted payload referencing a dangerous class
   (e.g., JNDI-connected gadget chains via JdbcRowSetImpl or similar)
3. FastJson deserializes the payload without validation
4. Malicious class is instantiated — OS command or callback executes
5. Attacker gains code execution in the context of the web server process

FastJson's @type mechanism — which allows callers to specify a Java class during deserialization — has historically been abused this way. Despite multiple rounds of denylist hardening, researchers have repeatedly found bypasses.

Scope and Impact

The attack campaign is currently focused on US firms, though the library's global deployment means any organization using FastJson in an internet-exposed application may be at risk. Successful exploitation allows attackers to:

• Execute arbitrary OS commands on the server
• Exfiltrate sensitive data (credentials, PII, intellectual property)
• Establish persistent backdoor access
• Pivot to internal network resources
• Deploy ransomware or destructive payloads

Immediate Mitigations

While no official patch is available for the exploited zero-day, organizations can take defensive steps now:

1. Audit FastJson Usage

# Scan your project dependencies
grep -r "fastjson" pom.xml build.gradle requirements.txt
 
# Check for the library in deployed JARs
find /opt/app -name "fastjson*.jar"

2. Apply Existing Hardening Flags

// Enable SafeMode (blocks all autotype by default — FastJson 1.2.68+)
ParserConfig.getGlobalInstance().setSafeMode(true);
 
// Or restrict autoType to specific trusted classes
ParserConfig.getGlobalInstance().addAccept("com.yourcompany.");

3. Upgrade to Latest FastJson 2.x

FastJson 2.x introduced a redesigned type resolution system that is not affected by legacy FastJson 1.x gadget chains:

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.57</version>
</dependency>

Note: FastJson 2.x is not a drop-in replacement — an API compatibility audit is required.

4. Network-Level Defenses

• Block outbound JNDI/LDAP connections from application servers at the firewall
• Deploy a WAF with rules targeting FastJson-style @type payloads
• Enable outbound network monitoring on application tier hosts
• Restrict application server egress to only required destinations

Detection

Context: FastJson's Security History

FastJson has a long history of critical deserialization vulnerabilities, including:

• CVE-2017-18349 — Original autotype RCE (CVSS 9.8)
• CVE-2022-25845 — Autotype bypass enabling RCE (CVSS 8.1)

Each patch has been followed by community-discovered bypasses, making migration to FastJson 2.x or an alternative library (Jackson, Gson) the recommended long-term solution.

Recommended Actions

1. Immediately enable SafeMode if on FastJson 1.x
2. Upgrade to FastJson 2.x or migrate to Jackson/Gson
3. Block outbound JNDI connections at the firewall/NDR layer
4. Deploy WAF rules targeting @type payload patterns
5. Monitor application logs for anomalous JSON POST patterns
6. Patch as soon as Alibaba releases a fix — subscribe to the FastJson GitHub security advisories

Related Reading

• Arista Patches VeloCloud Orchestrator Zero-Day Exploited in Attacks
• Russian Hackers Exploit Zimbra Zero-Day Against US & Ukraine Targets
• PTC Windchill Vulnerability Exploited in Ransomware Campaign