{"id":"CVE-2017-18349","aliases":["EUVD-2018-0715","GHSA-xjrr-xv9m-4pw5"],"status":"published","title":"Improper Input Validation in alilibaba:fastjson","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.38843,"percentile":0.98596,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2018-10-23T20:00:00Z","modified":"2026-10-24T14:08:51Z","exploits":[{"source":"pocgithub","id":"h0cksr/Fastjson--CVE-2017-18349-","title":"h0cksr/Fastjson--CVE-2017-18349-","date":"2022-04-14","url":"https://github.com/h0cksr/Fastjson--CVE-2017-18349-"},{"source":"pocgithub","id":"Dungsocool/CVE-2017-18349","title":"Dungsocool/CVE-2017-18349","date":"2026-05-29","url":"https://github.com/Dungsocool/CVE-2017-18349"},{"source":"pocgithub","id":"dichen-L/CVE-2017-18349-fastjson1.2.24-vul","title":"dichen-L/CVE-2017-18349-fastjson1.2.24-vul","date":"2026-11-05","url":"https://github.com/dichen-L/CVE-2017-18349-fastjson1.2.24-vul"},{"source":"nuclei","id":"CVE-2017-18349","title":"Fastjson Insecure Deserialization - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18349.yaml"}],"fixes":[{"ecosystem":"Maven","package":"com.alibaba:fastjson","fixed_in":["1.2.31"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"ro.pippo:pippo-fastjson","fixed_in":["1.12.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.24"},{"fixed":"1.2.31"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"ro.pippo:pippo-fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.alibaba:fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.31"}]}],"versions":["1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.20","1.1.21","1.1.22","1.1.23","1.1.24","1.1.25","1.1.26","1.1.27","1.1.28","1.1.29","1.1.30","1.1.31","1.1.31.sec01","1.1.31.sec04","1.1.31.sec06","1.1.31.sec07","1.1.31.sec10","1.1.31_noneautotype","1.1.32","1.1.33","1.1.33.android","1.1.33.sec01","1.1.33.sec04","1.1.33.sec06","1.1.33.sec10","1.1.34","1.1.34.android","1.1.34.sec01","1.1.34.sec04","1.1.34.sec06","1.1.34.sec09","1.1.34.sec10","1.1.34_noneautotype","1.1.35","1.1.36","1.1.37","1.1.38","1.1.39","1.1.40","1.1.41","1.1.41.sec01","1.1.41.sec04","1.1.41.sec06","1.1.41.sec10","1.1.42","1.1.42.android","1.1.43","1.1.43.android","1.1.44","1.1.44.android","1.1.45","1.1.45.android","1.1.46","1.1.46.android","1.1.46.sec01","1.1.46.sec04","1.1.46.sec06","1.1.46.sec09","1.1.46.sec10","1.1.46_noneautotype","1.1.47.android","1.1.48.android","1.1.49.android","1.1.50.android","1.1.51.android","1.1.52.android","1.1.53.android","1.1.54.android","1.1.55.android","1.1.56.android","1.1.57.android","1.1.58.android","1.1.59.android","1.1.60.android","1.1.61.android","1.1.62.android","1.1.63.android","1.1.64.android","1.1.65.android","1.1.66.android","1.1.67.android","1.1.68.android","1.1.69.android","1.1.70.android","1.1.70.android_noneautotype","1.1.71.android","1.1.72.android","1.1.73.android","1.1.76.android","1.1.76.android_noneautotype","1.1.77.android_noneautotype","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.13.sec01","1.2.14","1.2.14.sec01","1.2.14.sec10","1.2.15","1.2.16","1.2.16.sec01","1.2.16.sec04","1.2.16.sec10","1.2.17","1.2.18","1.2.19","1.2.2","1.2.2.sec01","1.2.2.sec10","1.2.20","1.2.21","1.2.22","1.2.23","1.2.24","1.2.25","1.2.25.sec10","1.2.26","1.2.27","1.2.27.sec06","1.2.27.sec09","1.2.27.sec10","1.2.28","1.2.28.odps","1.2.29","1.2.29.sec04","1.2.29.sec06","1.2.29.sec09","1.2.29.sec10","1.2.3","1.2.30","1.2.4","1.2.4.sec01","1.2.4.sec04","1.2.4.sec09","1.2.4.sec10","1.2.5","1.2.6","1.2.7","1.2.7.sec01","1.2.7.sec04","1.2.7.sec06","1.2.7.sec09","1.2.7.sec10","1.2.8","1.2.8.sec01","1.2.8.sec04","1.2.8.sec05","1.2.8.sec06","1.2.8.sec09","1.2.8.sec10","1.2.8.sec10_noneautotype","1.2.8_noneautotype","1.2.9"]},{"source":"osv","ecosystem":"Maven","package":"ro.pippo:pippo-fastjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"versions":["0.10.0","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.7.0","0.8.0","0.9.0","0.9.1","1.0.0","1.1.0","1.10.0","1.11.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"]}],"products":[{"vendor":"alibaba","product":"fastjson"},{"vendor":"pippo","product":"pippo"}],"references":[{"url":"https://fortiguard.com/encyclopedia/ips/44059","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://github.com/alibaba/fastjson/wiki/security_update_20170315","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://github.com/pippo-java/pippo/issues/466","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18349","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xjrr-xv9m-4pw5","tags":["advisory"]},{"url":"https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2","tags":["web"]},{"url":"https://github.com/alibaba/fastjson","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-18349","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-23T20:00:00Z","modified":"2024-09-17T00:02:21.255Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2018-0715","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-23T20:00:00Z","modified":"2024-09-17T00:02:21Z","updated_at":"2026-11-03T00:29:02.472621Z"}],"ghsa":[{"id":"GHSA-xjrr-xv9m-4pw5","title":"Improper Input Validation in alilibaba:fastjson","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-24T19:42:03Z","modified":"2023-09-26T14:52:01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2017-18349","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-23T20:29:00.263Z","modified":"2026-06-17T01:12:39.987Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:19.545286Z"}],"osv":[{"id":"CVE-2017-18349","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-23T20:29:00.263Z","modified":"2026-10-24T14:08:51.122693432Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"GHSA-xjrr-xv9m-4pw5","title":"Improper Input Validation in alilibaba:fastjson","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","status":"published","published":"2018-10-24T19:42:03Z","modified":"2024-02-16T07:59:10.562257Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}