CVE-2025-70974: FASTJSON Includes Functionality from Untrusted Control Sphere
(updated )
Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
References
- access.redhat.com/security/cve/CVE-2025-70974
- bugzilla.redhat.com/show_bug.cgi?id=2428203
- github.com/advisories/GHSA-jm7w-5684-pvh8
- github.com/alibaba/fastjson/compare/1.2.47...1.2.48
- github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce
- nvd.nist.gov/vuln/detail/CVE-2025-70974
- web.archive.org/web/20220121055754/https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955
- www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger
- www.cnvd.org.cn/flaw/show/CNVD-2019-22238
- www.freebuf.com/vuls/208339.html
- www.seebug.org/vuldb/ssvid-98020
Code Behaviors & Features
Detect and mitigate CVE-2025-70974 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →