New Plug-in for Detecting Deserialization Remote Code Execution Vulnerability in FastJSON Versions Earlier Than 1.2.61
Sep 20 2019
A new plug-in is released to detect the deserialization Remote Code Execution (RCE) vulnerability in the FastJSON component whose versions are earlier than 1.2.61. We recommend that you perform security checks.
Content
Target customers: all users who use FastJSON versions earlier than 1.2.61. Features released: The Alibaba Cloud Emergency Response Center has detected that the official GitHub repository of FastJSON disclosed a newly discovered deserialization RCE vulnerability. By exploiting this latest RCE gadget chain, attackers can execute arbitrary commands on servers remotely and subsequently gain full control over server privileges, posing a severe security risk. The FastJSON team has released version 1.2.61 to address this vulnerability. All users who use FastJSON are strongly recommended upgrading FastJSON to the latest version 1.2.61 and perform security checks at the earliest opportunity.
