# Fastjson Security Audit

> Fastjson All-Version Vulnerability Analysis and Detection
> Related Modules: `java_gadget_chains.md` (Gadget Chains) | `java_practical.md` (Practical Detection)

---

## Version Risk Matrix

| Version Range | Risk Level | Primary Vulnerability |
|--------------|-----------|----------------------|
| < 1.2.25 | Critical | Unrestricted deserialization RCE |
| 1.2.25-1.2.41 | Critical | AutoType bypass |
| 1.2.42-1.2.47 | Critical | Cache bypass, hash collision |
| 1.2.48-1.2.67 | High | Specific Gadget exploitation |
| 1.2.68-1.2.82 | Medium | expectClass bypass |
| >= 1.2.83 / 2.x | Safe* | Requires safeMode enabled |

---

## Quick Detection

```bash
# Dependency version check
grep -rn "fastjson.*<version>" pom.xml build.gradle
grep -rn "fastjson.*1\\.2\\.[0-7]" pom.xml  # High-risk versions

# Dangerous call detection
grep -rn "JSON\.parse\|JSON\.parseObject" --include="*.java"
grep -rn "@type" --include="*.java" --include="*.json"
grep -rn "ParserConfig.*setAutoTypeSupport" --include="*.java"
```

---

## Vulnerability Principles

### AutoType Mechanism

```java
// Dangerous: @type specifies arbitrary class
String json = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",...}";
JSON.parseObject(json);  // Deserializes arbitrary class → RCE
```

### Common Gadgets

| Gadget | Exploitation Method | Applicable Versions |
|--------|-------------------|-------------------|
| JdbcRowSetImpl | JNDI injection | < 1.2.25 |
| TemplatesImpl | Bytecode execution | < 1.2.48 |
| BasicDataSource | JNDI/BCEL | Multiple version bypasses |
| C3P0 | JNDI | With C3P0 dependency |

> Full Gadget Chains: `references/languages/java_gadget_chains.md#fastjson-series`

---

## Version Bypass Techniques

### 1.2.25-1.2.41 Bypass

```json
// L prefix bypass
{"@type":"Lcom.sun.rowset.JdbcRowSetImpl;","dataSourceName":"ldap://..."}

// [ prefix bypass
{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{...}]}
```

### 1.2.42-1.2.47 Cache Bypass

```json
// Double-write bypass
{"@type":"LLcom.sun.rowset.JdbcRowSetImpl;;"}

// Hash collision
{"@type":"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory"}
```

### 1.2.68+ expectClass Bypass

```json
// AutoCloseable subclass
{"@type":"java.lang.AutoCloseable","@type":"...actual malicious class..."}
```

---

## Safe Configuration

```java
// Recommended: enable safeMode (1.2.68+)
ParserConfig.getGlobalInstance().setSafeMode(true);

// Recommended: upgrade to 2.x and enable safe mode
// Fastjson2 is safer by default, but still requires configuration

// Dangerous: enable AutoType
ParserConfig.getGlobalInstance().setAutoTypeSupport(true);

// Dangerous: add whitelist but incomplete
ParserConfig.getGlobalInstance().addAccept("com.myapp.");
```

---

## Audit Checklist

```
[ ] Check Fastjson version (pom.xml / build.gradle)
[ ] Search for JSON.parse / JSON.parseObject calls
[ ] Check if AutoType is enabled
[ ] Check if safeMode is enabled
[ ] Verify whitelist configuration completeness
[ ] Trace JSON parsing data sources (user-controllable?)
```

---

## Fix Recommendations

1. **Upgrade Version**: >= 1.2.83 or migrate to Fastjson2
2. **Enable safeMode**: `ParserConfig.getGlobalInstance().setSafeMode(true)`
3. **Disable AutoType**: Ensure `setAutoTypeSupport(false)`
4. **Input Validation**: Apply schema validation to external JSON
5. **Consider Alternatives**: Jackson (safer when configured correctly)

---

## Related Modules

- `java_gadget_chains.md` - Fastjson Gadget Chain Details
- `java_practical.md` - Practical Detection Rules and Cases
- `java_jndi_injection.md` - JNDI Injection Principles
