Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

A critical Remote Code Execution (RCE) vulnerability exists in Fastjson 1.x, a Java JSON library developed by Alibaba. Attackers are exploiting this flaw to execute code without authentication within Spring Boot applications. The vulnerability stems from a type-resolution path that allows an attacker-controlled `@type` value to be treated as a class-resource lookup, enabling the loading of attacker-controlled bytecode.

Alibaba has not yet released a patch for this issue, and as of July 25th, the latest standard 1.x release is 1.2.83, while 1.2.83_noneautotype is available as a restricted build. Imperva reported in-the-wild exploitation activity targeting financial services, healthcare, computing, and retail organizations, with a notable presence in the United States and Singapore.

The exploit requires a Spring Boot executable fat-JAR, a network-reachable path sending attacker-controlled JSON, and SafeMode left disabled. Alibaba lists plain non-fat JARs, generic uber-JARs, and Tomcat or Jetty WAR deployments as unaffected. The vulnerability is not mitigated by simply binding input to a fixed class, as it requires an object containing an Object or Map field where the payload can be nested.

ThreatBook detected in-the-wild exploitation two days prior to publishing its findings, while Imperva reported activity using browser impersonators and Ruby/Go tools. Neither vendor provided attack counts, raw requests, or confirmed compromises. CISA, however, has not yet marked the vulnerability as exploited.

Organizations should inventory direct and transitive Fastjson dependencies and inspect affected systems for suspicious `@type` values, nested JAR URLs, unexpected outbound connections, child processes, and file changes. Fastjson2 is not affected because it does not use the same resource-probing or annotation-based trust path.