CVE-2022-25845

high-risk

Published 2022-06-10

The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).

Do I need to act?

88.4% chance of exploitation in next 30 days

EPSS score — higher than 12% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (2)

Fastjson

Communications Cloud Native Core Unified Data Repository

Affected Vendors

Oracle Alibaba

References (14)

Patch https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a...

Patch https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301...

Release Notes https://github.com/alibaba/fastjson/releases/tag/1.2.83

Third Party Advisory https://github.com/alibaba/fastjson/wiki/security_update_20220523

Third Party Advisory https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222

Exploit https://www.ddosi.org/fastjson-poc/

Patch https://www.oracle.com/security-alerts/cpujul2022.html

Patch https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a...

Patch https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301...

Release Notes https://github.com/alibaba/fastjson/releases/tag/1.2.83

Third Party Advisory https://github.com/alibaba/fastjson/wiki/security_update_20220523

Third Party Advisory https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222

Exploit https://www.ddosi.org/fastjson-poc/

Patch https://www.oracle.com/security-alerts/cpujul2022.html

/ 100

high-risk

Severity 24/34 · High

Exploitability 20/34 · Moderate

Exposure 7/34 · Low