fastjson-exploit

name	fastjson-exploit
description	Fastjson 1.2.24-1.2.47 JNDI injection RCE via autoType bypass (CVE-2019-14540). Targets Java REST APIs that deserialize user-supplied JSON using the Fastjson library.
metadata	{"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}}

fastjson-exploit

Exploits Fastjson autoType deserialization to trigger JNDI injection (CVE-2019-14540, CVE-2017-18349), achieving RCE on Java backends.

Target Framework

Fastjson 1.2.24 through 1.2.47 — widely used in Chinese Java microservice stacks (Spring Boot, Dubbo, etc.).

Usage

Provide target (endpoint URL that accepts JSON). The skill crafts a malicious JSON payload pointing to an attacker-controlled JNDI server, then reads back the RCE result.

Parameters

Param	Type	Required	Description
target	string	yes	HTTP endpoint that parses Fastjson input
jndi_url	string	no	JNDI server URL (auto-starts jndi_exploit)
cmd	string	no	OS command to execute (default: id)
timeout	int	no	Timeout in seconds (default: 30)

Notes

Works best combined with jndi_exploit skill to host the JNDI/LDAP callback server. Verify Fastjson presence via error message fingerprinting before exploitation.