PT-2018-6845 · None+1 · Pippo+1

Published 2018-10-23 · Updated 2019-01-28 · CVE-2017-18349

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fastjson versions prior to 1.2.25 Pippo version 1.11.0

Description: The issue allows remote attackers to execute arbitrary code via a crafted JSON request. This can be achieved by sending a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

Recommendations: For Fastjson versions prior to 1.2.25, update to version 1.2.25 or later to resolve the issue. For Pippo version 1.11.0, consider disabling the parseObject function in FastjsonEngine as a temporary workaround until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-18349

GHSA-XJRR-XV9M-4PW5

Affected Products

Fastjson

Pippo

References · 10

• 🔥 https://github.com/pippo-java/pippo/issues/466 · Exploit
• 🔥 https://github.com/h0cksr/Fastjson--CVE-2017-18349- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18349 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18349 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xjrr-xv9m-4pw5 · Vendor Advisory
• https://github.com/alibaba/fastjson/wiki/security_update_20170315 · Note
• https://github.com/alibaba/fastjson · Note
• https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2 · Note
• https://fortiguard.com/encyclopedia/ips/44059 · Note
• https://github.com/advisories/GHSA-xjrr-xv9m-4pw5 · Note