跪拜 Guibai
← All articles
Backend

Fastjson 1.x Hit by New Gadget-Free RCE, Default Configs Exposed

By 神奇小汤圆 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Any Spring Boot service that swapped in Fastjson 1.x for JSON parsing is reachable with default settings. The gadget-free nature of the exploit means the usual stopgap—purging dangerous classes—provides no protection, so only a version upgrade or a move to Fastjson 2.x closes the hole.

Summary

Fastjson versions 1.2.68 to 1.2.83 contain a critical RCE that works under default configurations—AutoType off and SafeMode off—when an attacker controls the JSON input. Unlike earlier Fastjson flaws that relied on specific gadget classes on the classpath, this exploit is gadget-free, meaning deleting or blocking known dangerous classes no longer stops it. Spring Boot fat-jar deployments across JDK 8, 11, 17, and 21 are confirmed reachable through standard parse entry points.

Fastjson 2.x is immune by design. It refuses to probe resources using attacker-supplied class names, enforces a whitelist-first type resolution, and ships with autoType disabled. The deprecated SupportAutoType flag is explicitly flagged as unsafe.

The immediate fix for 1.x users is upgrading to 1.2.84 or enabling SafeMode. The recommended long-term path is migrating to fastjson2, which carries safer defaults and architectural protections against this class of attack.

Takeaways
Fastjson 1.2.68 through 1.2.83 allows remote code execution under default configs when an attacker controls the JSON payload.
The exploit is gadget-free: it does not depend on specific third-party classes on the classpath, so deleting known dangerous classes is ineffective.
Spring Boot fat-jar deployments on JDK 8, 11, 17, and 21 are confirmed vulnerable via JSON.parse, JSON.parseObject(String), and JSON.parseObject(String, Class).
Fastjson 2.x is not affected; it uses whitelist-first type resolution, disables autoType by default, and blocks resource probing via user-controlled class names.
Upgrade Fastjson 1.x to 1.2.84, or enable SafeMode as a temporary mitigation.
Long-term fix is migrating to fastjson2, but avoid explicitly enabling the deprecated SupportAutoType flag.
Spring Boot's default JSON library is Jackson, so projects that never added Fastjson are not exposed.
Conclusions

Gadget-free deserialization attacks shift the threat model: the library itself becomes the attack surface, not the classpath. This makes version upgrades the only reliable fix.

Fastjson 1.x was officially discontinued in 2024, yet production exposure remains widespread enough that a critical advisory still triggers urgent patching campaigns.

The architectural gap between Fastjson 1.x and 2.x is stark—2.x's whitelist-first design and disabled autoType are table-stakes defenses that 1.x never adopted by default.

Concepts & terms
Gadget-free RCE
A deserialization attack that achieves remote code execution without relying on specific third-party 'gadget' classes on the application's classpath. The exploit chain uses only the library's own internal logic, making classpath-based mitigations ineffective.
SafeMode (Fastjson)
A configuration flag in Fastjson 1.x that disables all autoType functionality, blocking deserialization attacks by refusing to instantiate arbitrary classes specified in JSON input.
autoType (Fastjson)
A Fastjson feature that allows the JSON payload to specify which Java class to deserialize into. When enabled without strict whitelisting, it is the primary entry point for deserialization-based remote code execution.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗