Sign in Create Account

Fastjson @JSONType jar: URL RCE

Bookmarked!

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

PRO Hard -- 0
Course

This challenge covers a remote code execution in fastjson 1.2.83 with autoType disabled, by abusing the @JSONType trust probe in ParserConfig.checkAutoType together with a jar:http:// class name loaded through Spring Boot's LaunchedURLClassLoader on JDK 8.

Included with PRO
Full course content Common mistakes

Ready to practice?

Get access to this lab and 600+ hands-on exercises with a PRO subscription.