PT-2026-1957 · Alibaba · Fastjson

Publicado 2026-01-09 · Atualizado 2026-01-10 · CVE-2025-70974

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alibaba Fastjson versions prior to 1.2.48

Description The software contains a critical deserialization issue due to improper handling of the autoType feature, which could allow for remote code execution. The issue arises when a JSON document includes an @type key with a Java class name as its value. This can lead to calls that enable remote code execution.

Recommendations Update to version 1.2.48 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2025-70974

GHSA-JM7W-5684-PVH8

Produtos afetados

Fastjson

Referências · 15

• https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48 · Nota
• https://github.com/alibaba/fastjson · Nota
• https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce · Nota
• https://web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-70974 · Nota de Segurança
• https://cnvd.org.cn/flaw/show/CNVD-2019-22238 · Nota
• https://twitter.com/pulsepatchio/status/2009994317461631362 · Publicação no Twitter
• https://freebuf.com/vuls/208339.html · Nota
• https://seebug.org/vuldb/ssvid-98020 · Nota
• https://twitter.com/0dayPublishing/status/2009519489793020073 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009526566695457120 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-jm7w-5684-pvh8 · Aviso do Fabricante
• https://cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger · Nota
• https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955 · Nota
• https://osv.dev/vulnerability/CVE-2025-70974 · Aviso do Fabricante