High-Severity RCE Vulnerability Reported in Popular Fastjson Library
Jun 16, 2022
Cybersecurity researchers have detailed a recently patched high-severity security vulnerability in the popular Fastjson library that could be potentially exploited to achieve remote code execution. Tracked as CVE-2022-25845 (CVSS score: 8.1), the issue relates to a case of deserialization of untrusted data in a supported feature called "AutoType." It was patched by the project maintainers in version 1.2.83 released on May 23, 2022. "This vulnerability affects all Java applications that rely on Fastjson versions 1.2.80 or earlier and that pass user-controlled data to either the JSON.parse or JSON.parseObject APIs without specifying a specific class to deserialize," JFrog's Uriya Yavnieli said in a write-up. Fastjson is a Java library that's used to convert Java Objects into their JSON representation and vice versa. AutoType , the function vulnerable to the flaw, is enabled by default and...
