Active Zero-Day Exploitation: FastJson Unauthenticated RCE Defense Guide

Security Arsenal is actively tracking a critical zero-day campaign targeting US firms via unpatched vulnerabilities in the FastJson open-source Java library. Attackers are leveraging a security flaw that permits unauthenticated remote code execution (RCE) without user interaction or elevated privileges.

Because this vulnerability is currently unpatched and actively exploited in the wild, standard patch cycles are insufficient. Defenders must assume breach and implement immediate compensating controls. This post outlines the technical mechanics of the threat, provides specific detection logic for your SIEM and EDR, and details hardening steps to shield your Java workloads.

Technical Analysis

Affected Component: com.alibaba.fast (FastJson), a widely used Java library for JSON parsing and serialization.

Vulnerability Type: Unsafe Deserialization / Autotype Bypass leading to Remote Code Execution.

Attack Chain:

Ingress: Attackers send a crafted HTTP request containing a malicious JSON payload to a vulnerable endpoint exposed by the application server (e.g., Spring Boot, Tomcat).
Parsing: The application utilizes FastJson to deserialize the JSON string.
Exploitation: FastJson's "AutoType" feature is abused to instantiate a malicious class specified in the payload. This triggers a gadget chain present in the application's classpath.
Execution: The gadget chain executes arbitrary code (e.g., spawning a shell) within the context of the Java application process.

Exploitation Status: Confirmed Active Exploitation. The absence of a CVE identifier in vendor advisories indicates a zero-day or a recently disclosed flaw for which a patch is not yet available.

Detection & Response

Due to the lack of a patch, detection is your primary defense. Successful exploitation of FastJson deserialization flaws typically results in the Java process (java, javaw) spawning child processes (shells) or making anomalous network connections.

SIGMA Rules

YAML

---
title: Potential FastJson Deserialization RCE - Java Spawning Shell
id: 8f4e9b10-a12c-4b33-9f5d-6c1e9b2f3a4e
status: experimental
description: Detects potential exploitation of Java deserialization vulnerabilities (like FastJson) by identifying the JVM spawning shell processes.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of them*
falsepositives:
  - Legitimate administrative scripts executed by Java applications
level: high
---
title: Potential FastJson Deserialization RCE - Linux Java Spawning Shell
id: 2c1a8f30-d45e-4f88-9a2b-3d4e5f6a7b8c
status: experimental
description: Detects potential exploitation of Java deserialization vulnerabilities on Linux by identifying java spawning bash or sh.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/jre/bin/java'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
  condition: all of them*
falsepositives:
  - Legitimate build pipelines or administrative utilities
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for Java processes spawning suspicious child processes (Windows & Linux)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "java")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for Java processes spawning shells or network tools
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "java"
   AND Name =~ "(cmd|powershell|pwsh|bash|sh|curl|wget)"

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# FastJson Zero-Day Asset Identification Script
# Scans for presence of fast jar files to identify potentially vulnerable assets

echo "[*] Scanning for FastJson libraries..."

# Find all fast jar files
find / -name "fast*.jar" -type f 2>/dev/null | while read jar_file; do
    echo "[+] FOUND: $jar_file"
    # Extract version if possible from filename (standard naming)
    if [[ $jar_file =~ fast-([0-9.]+).jar ]]; then
        echo "    Version detected: ${BASH_REMATCH[1]}"
    fi
    # Check if running processes are using this specific jar
    lsof "$jar_file" 2>/dev/null && echo "    [!] WARNING: File is actively loaded by a process!"
done

echo "[*] Scan complete. Review identified paths and review application configurations for 'AutoType' settings."

Remediation

As this is an active zero-day with no available patch, execute the following mitigations immediately:

Disable AutoType (Critical Mitigation): Modify your application code or configuration to explicitly disable the AutoType feature in FastJson. This is the primary vector for these attacks.
- Code Fix: ParserConfig.getGlobalInstance().setAutoTypeSupport(false);
- Safe Mode: Enable SafeMode if the version supports it (@JSONField(safe=true) or global settings).
WAF Configuration:

SQL

    Update Web Application Firewall rules to inspect JSON payloads. Block requests containing suspicious class names or Java object syntax in JSON fields (e.g., `@type`, `@type`).

Network Segmentation: Restrict outbound internet access from application servers running FastJson. Successful exploitation often results in the process reaching out to Command and Control (C2) servers. Block all unnecessary egress traffic.
Asset Inventory: Use the provided script above to identify all instances of FastJson in your environment. Prioritize external-facing applications for immediate mitigation.
Vendor Monitoring: Subscribe to official Alibaba FastJson channels and CISA alerts for the immediate release of a security patch once available.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub