PT-2022-2951 · Alibaba · Fastjson

Unknown · Published 2022-05-06 · Updated 2025-07-19 · CVE-2022-25845

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions com.alibaba:fastjson versions prior to 1.2.83

Description The vulnerability is related to the deserialization of untrusted data by bypassing the default autoType shutdown restrictions in the Fastjson library. This can be exploited under certain conditions, allowing attackers to execute remote code. The issue is associated with the AutoTypeCheck mechanism in Fastjson, which can lead to security problems during deserialization if the JSON is controlled by the user and AutoType is enabled.

Recommendations For versions prior to 1.2.83, update to version 1.2.83 or later. As a temporary workaround, consider enabling safeMode, which disables the AutoType feature, effectively closing deserialization attack vectors.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-03553

CVE-2022-25845

GHSA-PV7H-HX5H-MGFJ

SNYK-JAVA-COMALIBABA-2859222

Affected Products

Fastjson

References · 25

• 🔥 https://github.com/hosch3n/FastjsonVulns · Exploit
• 🔥 https://github.com/luelueking/CVE-2022-25845-In-Spring · Exploit
• 🔥 https://ddosi.org/fastjson-poc · Exploit
• 🔥❌ https://github.com/Expl0desploit/CVE-2022-25845 · Exploit, Deleted
• https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15 · Patch
• https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d · Patch
• https://bdu.fstec.ru/vul/2022-03553 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25845 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25845 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/GHSA-pv7h-hx5h-mgfj · Vendor Advisory
• https://github.com/alibaba/fastjson/wiki/fastjson_safemode · Note
• https://github.com/alibaba/fastjson · Note
• https://github.com/alibaba/fastjson/wiki/security_update_20220523 · Note
• https://github.com/alibaba/fastjson/releases/tag/1.2.83 · Note