القائمة
Fastjson 1.2.24-1.2.47 JNDI injection RCE via autoType bypass (CVE-2019-14540). Targets Java REST APIs that deserialize user-supplied JSON using the Fastjson library.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Fast HTTP probing and lightweight fingerprinting using ProjectDiscovery httpx. Use for web recon with redirect-awareness and JSON output.
V5 样板 Micro-Skill：Pydantic 入参、micro_executor SDK、落盘 parsed.json、stderr S-06、stdout Agent 摘要 JSON（嵌入 raw_stdout）。
Build a basic understanding of the current project by scanning source code and available docs. Use when user asks for /init, project onboarding, quick repo familiarization, or initial architecture context.
Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics.
Raw HTTP probing with curl. Use for custom method, headers and body requests in recon and validation.
Advanced web path scanner using multithreaded brute-force. Use for discovering hidden files, directories, and endpoints on web servers.
| name | fastjson-exploit |
| description | Fastjson 1.2.24-1.2.47 JNDI injection RCE via autoType bypass (CVE-2019-14540). Targets Java REST APIs that deserialize user-supplied JSON using the Fastjson library. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}} |
Exploits Fastjson autoType deserialization to trigger JNDI injection (CVE-2019-14540, CVE-2017-18349), achieving RCE on Java backends.
Fastjson 1.2.24 through 1.2.47 — widely used in Chinese Java microservice stacks (Spring Boot, Dubbo, etc.).
Provide target (endpoint URL that accepts JSON). The skill crafts a malicious JSON payload pointing to an attacker-controlled JNDI server, then reads back the RCE result.
| Param | Type | Required | Description |
|---|---|---|---|
| target | string | yes | HTTP endpoint that parses Fastjson input |
| jndi_url | string | no | JNDI server URL (auto-starts jndi_exploit) |
| cmd | string | no | OS command to execute (default: id) |
| timeout | int | no | Timeout in seconds (default: 30) |
Works best combined with jndi_exploit skill to host the JNDI/LDAP callback server. Verify Fastjson presence via error message fingerprinting before exploitation.
