CVE-2017-18349 Improper Input Validation in alilibaba:fastjson
CriticalCVSS 9.8
EPSS 38.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.alibaba/fastjson(Maven) | <= 1.2.24 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | < 1.12.0 | 1.12.0 |
| com.alibaba/fastjson(Maven) | < 1.2.31 | 1.2.31 |
| com.alibaba/fastjson(Maven) | = 1.1.15 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.16 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.17 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.18 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.19 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.20 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.21 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.22 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.23 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.24 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.25 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.26 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.27 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.28 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.29 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.30 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31.sec07 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.31.sec10 | No fix listed |
Show 164 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.alibaba/fastjson(Maven) | = 1.1.31_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.32 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.33.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.34_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.35 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.36 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.37 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.38 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.39 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.40 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.41 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.41.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.41.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.41.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.41.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.42 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.42.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.43 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.43.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.44 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.44.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.45 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.45.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.46_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.47.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.48.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.49.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.50.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.51.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.52.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.53.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.54.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.55.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.56.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.57.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.58.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.59.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.60.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.61.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.62.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.63.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.64.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.65.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.66.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.67.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.68.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.69.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.70.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.70.android_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.71.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.72.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.73.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.76.android | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.76.android_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.1.77.android_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.0 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.1 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.11 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.12 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.13 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.13.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.14 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.14.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.14.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.15 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.16 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.16.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.16.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.16.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.17 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.18 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.19 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.2 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.2.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.2.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.20 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.21 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.22 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.23 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.24 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.25 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.25.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.26 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.27 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.27.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.27.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.27.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.28 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.28.odps | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.29 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.29.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.29.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.29.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.29.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.3 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.30 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.4 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.4.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.4.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.4.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.4.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.5 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.6 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.7.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec01 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec04 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec05 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec06 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec09 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec10 | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8.sec10_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.8_noneautotype | No fix listed |
| com.alibaba/fastjson(Maven) | = 1.2.9 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.10.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.4.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.4.1 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.4.2 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.5.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.6.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.6.1 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.7.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.8.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.9.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 0.9.1 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.0.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.1.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.10.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.11.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.2.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.3.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.4.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.5.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.6.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.7.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.8.0 | No fix listed |
| ro.pippo/pippo-fastjson(Maven) | = 1.9.0 | No fix listed |
| Alibaba Fastjson | < 1.2.25 | 1.2.25 |
| pippo | = 1.11.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit third-party-advisory
- fortiguard.com mitigation third-party-advisory
- github.com vendor-advisory
- github.com mitigation third-party-advisory
- github.com patch
- github.com product