| name | fastjson-exploit |
| description | Fastjson 1.2.24-1.2.47 JNDI injection RCE via autoType bypass (CVE-2019-14540). Targets Java REST APIs that deserialize user-supplied JSON using the Fastjson library. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}} |
fastjson-exploit
Exploits Fastjson autoType deserialization to trigger JNDI injection (CVE-2019-14540, CVE-2017-18349), achieving RCE on Java backends.
Target Framework
Fastjson 1.2.24 through 1.2.47 — widely used in Chinese Java microservice stacks (Spring Boot, Dubbo, etc.).
Usage
Provide target (endpoint URL that accepts JSON). The skill crafts a malicious JSON payload pointing to an attacker-controlled JNDI server, then reads back the RCE result.
Parameters
| Param | Type | Required | Description |
|---|
| target | string | yes | HTTP endpoint that parses Fastjson input |
| jndi_url | string | no | JNDI server URL (auto-starts jndi_exploit) |
| cmd | string | no | OS command to execute (default: id) |
| timeout | int | no | Timeout in seconds (default: 30) |
Notes
Works best combined with jndi_exploit skill to host the JNDI/LDAP callback server. Verify Fastjson presence via error message fingerprinting before exploitation.
