CVE-2017-18349
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
9.8
CVSS
39.0%
EPSS (exploit prob.)
99th
EPSS percentile
2018-10-23
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| alibaba | fastjson | < 1.2.25 |
| pippo | pippo | 1.11.0 |
Check a specific version with /api/v1/cve/match.
References
- https://fortiguard.com/encyclopedia/ips/44059
- https://github.com/alibaba/fastjson/wiki/security_update_20170315
- https://github.com/pippo-java/pippo/issues/466
- https://fortiguard.com/encyclopedia/ips/44059
- https://github.com/alibaba/fastjson/wiki/security_update_20170315
- https://github.com/pippo-java/pippo/issues/466
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2017-18349