GCSA insightsIn-depth analysis and defense guide for the fastjson 1.2.83 “gadget-free” vulnerability (0day)

GCSA Global Cybersecurity Alliance released a report detailing a Fastjson 1.2.83 RCE exploit reproduced across multiple JDK versions.

The GCSA Global Cybersecurity Alliance today exclusively released a technical insight report: Fastjson 1.2.83 can trigger remote code execution (RCE) without relying on traditional Gadget dependencies, even with the default AutoType=false setting. This exploit technique has been successfully reproduced end-to-end on JDK 8, 17, 21, and 25, as well as within Spring Boot Loader isolation environments.

This vulnerability is not a traditional “bypass the blacklist to find a local Gadget” attack. Instead, it directly subverts Fastjson’s own class metadata detection logic to serve as a channel for acquiring remote malicious classes. An attacker who can control the JSON input parsed by Fastjson — with SafeMode disabled and outbound network access available — can achieve unauthenticated remote code execution without requiring any pre-installed traditional Gadget dependencies (such as TemplatesImpl, JNDI, or Commons Collections) in the target classpath.

Reproduction results confirm that the same JSON payload achieves successful RCE across Temurin JDK 8, 17, 21, and 25 with Spring Boot Loader environments. The vulnerability is rated as high severity: the attack vector is network-remote, requires no user interaction, and the impact on confidentiality, integrity, and availability is all rated high.

Key findings

“AutoType is disabled by default, so it’s safe” — Invalid

“Fixed parseObject second parameter, so it’s safe” — Invalid

“No known Gadgets in the classpath, so it’s safe” — Invalid

“JDK 17+ rejects http:// internal names, so at most it’s just SSRF” — Invalid

Defense recommendations

• Immediately enable SafeMode: ParserConfig.getGlobalInstance().setSafeMode(true);
• Migrate to Fastjson 2.x as a priority and complete regression testing
• Restrict outbound network policies: block JVM HTTP connections to non-essential external addresses
• Deploy WAF/gateway rules to block JSON requests where the decoded key equals @type