DEV Community

Anoymask
Anoymask

Posted on

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars

#security #threatintel

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars

1. Basic Information

2. Summary

This is an actively exploited vulnerability in end-of-life Fastjson 1.x used within Spring Boot fat-jars. If an attacker sends a crafted JSON request without authentication, it can reach remote code execution (RCE) with Java process permissions via external resource lookups, even when AutoType is not explicitly enabled.

3. Attack Flow

  1. The attacker scans for publicly exposed JSON-receiving endpoints.
  2. The attacker sends a crafted JSON payload containing @type.
  3. Fastjson 1.x type resolution logic treats the @JSONType annotation as a trust signal.
  4. The application bypasses AutoType restrictions and triggers a lookup to an attacker-controlled resource.
  5. Vulnerable Spring Boot fat-jar configurations reach the code execution path without external gadgets.
  6. Arbitrary code runs with the execution permissions of the Java application user.
  7. Inference: The attack may proceed to drop webshells, search for credentials, access cloud metadata, and deploy lateral movement tools.

4. Attacker Position and Execution Location

  • The attacker sends HTTP(S) requests from the internet or an accessible internal network.
  • The vulnerability is processed by Fastjson 1.x inside the Spring Boot application.
  • The final payload runs with OS or container permissions of the Java process.
  • The lookup destination can be attacker-controlled infrastructure.

5. Visibility for Victims and Administrators

  • User interaction or login is not required.
  • The application may continue to respond as a normal JSON API.
  • WAFs or proxies may see JSON with suspicious @type, external lookups, and unusual User-Agents.
  • Endpoints may show shells spawned from Java, downloaders, and outbound network traffic as primary indicators.

6. Success and Failure Conditions

Success Conditions

  • Fastjson versions 1.2.68 to 1.2.83 are in use.
  • The application is deployed as a Spring Boot executable fat-jar.
  • SafeMode is disabled.
  • The attacker successfully makes the application process the JSON.
  • The application can communicate with the lookup destination or subsequent C2 servers.

Failure Conditions

  • The application has migrated to Fastjson 2.x.
  • SafeMode is enabled.
  • A custom build removes the vulnerable code.
  • A WAF or API Gateway blocks the malicious JSON.
  • Egress controls block external lookups.
  • The Java process runs with least privilege and container isolation limits subsequent impact.

7. What Happens on Success

Arbitrary code runs with Java process permissions. This allows attackers to steal application settings, environment variables, database or API credentials, tamper with data, and deploy additional malware. If the container or cloud IAM role has high privileges, the impact may expand to the host or the cloud environment.

8. Observable Logs

Email

  • None.

Proxy / SWG / DNS

  • DNS or HTTP traffic from the Java application to unknown domains.
  • External resource lookups immediately following the attack.
  • POST requests from Ruby/Go-based tools or user-agents disguised as browsers.

Endpoint / EDR

  • sh, bash, cmd.exe, powershell.exe, curl, or wget spawned as child processes of java.
  • The Java process writing to temporary directories, web roots, cron, or systemd.
  • Abnormal enumeration by the application execution user.

Identity / IdP

  • Abnormal use of application service accounts.
  • Database, cloud, or SaaS authentication after credential theft.

SaaS / Cloud

  • Access to metadata services.
  • Enumeration and secret retrieval via workload IAM roles.
  • Management API calls originating from containers.

Network

  • Repeated POST requests to JSON endpoints.
  • New outbound traffic from the application server to unknown destinations.
  • Subsequent internal scanning and connections to database or management ports.

9. Attack Success Assessment

  • Contact Only: Vulnerability URL scanning and POST requests containing attack strings.
  • User Interaction: Not required.
  • Initial Execution: Abnormal child processes from Java, successful lookup, and payload retrieval.
  • Malware or Successful Auth: Execution of new binaries and abuse of service accounts.
  • Data Theft / Session Compromise: Reading secrets and outbound data transfer.
  • Subsequent Compromise Confirmation: Webshells, persistence, lateral movement, and cloud IAM changes.

10. Investigation Playbook

Trigger

Suspicious JSON containing @type, Java child processes, and unknown outbound traffic from the application server.

Initial Verification

  1. Verify the exact version of Fastjson via SBOM, JARs, and dependencies.
  2. Check the fat-jar configuration and SafeMode status.
  3. Identify the initial attack POST request, source IP, response, and immediate outbound traffic.

Endpoint

  • Preserve the Java process tree, command lines, open files, and network connections.
  • Investigate temporary directories, web roots, services, cron jobs, and container file system differences.
  • Collect hashes of memory, JARs, and suspicious files.

Authentication & Cloud

  • Rotate credentials found in environment variables, configuration files, and secrets.
  • Check workload identity API calls, metadata access, and abnormal token issuance.

Subsequent Activity

  • Search for internal discovery, database access, archiving, outbound transfers, webshells, and persistence.

Containment

  • Temporarily block the target API or protect it with a WAF.
  • Upgrade to Fastjson 2.x, or immediately apply SafeMode and egress controls if upgrading is difficult.
  • Rebuild hosts or containers if signs of compromise are found.

Verdict Categories

Scanning / Exploit Attempt / RCE Confirmed / Credential Access / Lateral Movement / Exfiltration Confirmed.

11. Defense and Detection Ideas

Single Events

  • Abnormal @type inside the JSON body.
  • OS shell execution spawned from Java.
  • Communication from Java to normally unused external domains.

Time-Series Correlation

Attack JSON POST → External lookup → Java child process → Payload retrieval → Internal discovery / Secret access

Threat Hunting Perspective

  • Inventory all corporate assets for fat-jars containing Fastjson 1.x.
  • Review historical logs for child processes spawned by Java and new outbound destinations.
  • Track changes in the ratio of browser-disguised and Ruby/Go-based traffic reported by Imperva.

Log Gaps

Assessing success or failure is difficult without HTTP request bodies, Java process trees, DNS logs, container audit logs, and cloud API audit logs.

Priority Countermeasures

  1. Migrate to Fastjson 2.x.
  2. Enable SafeMode.
  3. Protect public APIs with a WAF.
  4. Minimize workload privileges and egress access.
  5. Detect Java child processes.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-16723 affects Fastjson versions 1.2.68 to 1.2.83.
  • It can be exploited in default configurations without enabling AutoType or external gadgets.
  • Spring Boot executable fat-jar configurations are affected.
  • Attacks have been observed across multiple industries in the US, Singapore, and Canada.
  • There are no official patches for the 1.x branch; migrating to 2.x or enabling SafeMode is recommended.

Inference

  • Database and cloud credentials held by Java processes will be primary targets for follow-up compromises.
  • Investigations must cover historical Java child processes and egress traffic, not just patch applications.

Hypothesis

  • Correlating @type POST requests with subsequent Java outbound lookups and shell executions provides high-confidence detection.
  • Unidentified embedded dependencies in Spring Boot applications globally may still be widely vulnerable.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application — High confidence.
  • T1059 Command and Scripting Interpreter — Medium confidence, if a shell is spawned after RCE.
  • T1105 Ingress Tool Transfer — Medium confidence, when retrieving additional payloads.
  • T1552 Unsecured Credentials — Estimated, during configuration and environment variable discovery.
  • T1071.001 Web Protocols — Medium confidence, if HTTP(S) C2 is used.
  • T1505.003 Web Shell — Only when deployment is confirmed.

14. Unknowns and Additional Investigations

  • Exact payloads, IOCs, and the number of compromised organizations observed publicly.
  • All conditions required to go from a lookup to code execution, and JDK differences.
  • Attacker groups, ultimate objectives, and subsequent malware.
  • Global exploitation status.

15. Impact on SOCs and Organizations

Fastjson may be included as a transitive dependency in Java business systems and internal APIs. Priorities must be determined by combining factors such as version, fat-jar usage, SafeMode, public exposure, and workload privileges. Active exploitation has been reported across manufacturing, finance, healthcare, and retail, making urgent asset inventories necessary for organizations worldwide.

16. Summary by Role

For SOCs

Correlate @type POST requests, Java external lookups, and Java child processes in a time-series manner to distinguish between contact attempts and successful RCEs.

For Administrators

Migrate Fastjson from 1.x to 2.x, and provisionally apply SafeMode, WAF rules, and egress controls. Conduct searches for signs of compromise at the same time.

For Users

Because servers can be compromised without user interaction, this requires urgent administrative response rather than actions from general users.

Top comments (0)