parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.alibaba:fastjson(Maven) | 0 | 1.2.31 | N/A |
| ro.pippo:pippo-fastjson(Maven) | 0 | 1.12.0 | N/A |
CVSS Metrics
