CVE-2017-18349: Improper Input Validation in com.alibaba:fastjson

com.alibaba:fastjson Updated 02 Oct 2025

Summary

24/10/2018

Disclosed on

CVE-2017-18349

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2017-18349: Improper Input Validation in alilibaba:fastjson. Affects com.alibaba:fastjson versions < 1.2.31. Fixed in 1.2.31. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

com.alibaba:fastjson is a popular JSON library for Java that provides fast and efficient JSON parsing and serialization capabilities. It is widely used in various applications and frameworks. However, versions before 1.2.25 of fastjson are vulnerable to an improper input validation issue.

Vulnerability Detail

The vulnerability, identified as CVE-2017-18349, exists in the parseObject function of fastjson. This vulnerability allows remote attackers to execute arbitrary code by sending a crafted JSON request. An attacker can exploit this vulnerability by including a specially crafted rmi:// URI in the dataSourceName field of an HTTP POST request to the Pippo /json URI. This input is mishandled in the AjaxApplication.java file, leading to arbitrary code execution. The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the affected system.

How To Fix

Minimum fixed version

1.2.31

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is strongly advised to apply the fix by upgrading to a non-vulnerable version of com.alibaba:fastjson.

Conclusion

In conclusion, the vulnerability CVE-2017-18349 in com.alibaba:fastjson allows remote code execution and can have severe consequences. It is crucial to upgrade to a fixed version of the library (1.2.31 or later) to mitigate the risk. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for com.alibaba:fastjson →