CVE-2017-18349

Think of this library like a translator that converts incoming messages into something the application understands. This flaw means the translator can be tricked into fetching and running instructions from an address the attacker chooses, instead of just translating the message — effectively handing the attacker the keys to the server.

This matters to you if any application you run — custom-built or vendor-supplied — relies on the Fastjson library, or on the Pippo web framework's fastjson component, to process JSON data. It affects the system automatically if the vulnerable version is in use and reachable, with no login or user action needed from anyone.

No confirmed active exploitation or government advisory listing has been reported for this flaw, but a public detection template exists and a crafted request is all it takes to trigger it with no login required, so it should be treated as a real and immediate risk to any exposed system. Given the lack of confirmed in-the-wild attacks, this warrants prompt attention and scheduling an update rather than an emergency, same-day response.

1. Inventory all applications to identify any dependency on com.alibaba:fastjson or ro.pippo:pippo-fastjson, including transitive dependencies pulled in via other libraries or frameworks. 2. Confirm exposure by checking whether any endpoint accepts and parses untrusted JSON (e.g., a /json-style API), especially one built on Pippo's AjaxApplication handling. 3. Upgrade com.alibaba:fastjson to >= 1.2.31 and ro.pippo:pippo-fastjson to >= 1.12.0; test for breaking changes in autotype/type-handling behavior introduced by Fastjson's post-1.2.25 security hardening. 4. If immediate upgrade isn't feasible, apply the vendor-documented mitigation disabling autotype and restricting deserialization of arbitrary class names (see alibaba/fastjson security_update_20170315 wiki) and consider the Fortinet IPS signature as a stopgap. 5. No CISA KEV due date applies since this CVE is not currently listed in KEV. 6. Monitor for outbound connections to unexpected RMI/LDAP/HTTP endpoints from application servers, and watch for new exploitation reports given the elevated EPSS percentile.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, no privileges or user interaction required, full compromise of confidentiality, integrity, and availability. Weakness class is CWE-20 (Improper Input Validation), manifesting as unsafe deserialization/autotype resolution in Fastjson's parseObject allowing remote class loading via attacker-controlled URIs (e.g., rmi://). Not listed in CISA KEV; EPSS places this in the 99th percentile with a falling trend, indicating historically high predicted exploitation likelihood though currently declining. A detection/exploit template exists publicly, but no confirmed active campaign has been reported; sustained press attention reflects historical notoriety rather than new activity.