Zero-Day RCE in FastJson: Active Exploitation and Detection Tips

Hey everyone,

Just saw the latest report regarding active exploitation of a zero-day vulnerability in the FastJson library. It appears US firms are being specifically targeted in these campaigns. What makes this particularly dangerous is that the vulnerability allows for Remote Code Execution (RCE) without requiring user interaction or elevated privileges on the target system.

For those unfamiliar, FastJson is a popular Java library for JSON processing. The root cause of many of these issues, including this zero-day, is typically the "AutoType" feature. When enabled, it allows the attacker to specify a Java class in the JSON payload using the @type field. The library then deserializes the object, executing arbitrary code contained in the referenced class's constructor or setters.

Since official patches might be delayed for this zero-day, defensive coding and WAF configurations are critical. We've started blocking requests containing @type outside of specific whitelisted contexts.

I wrote a quick Python snippet to analyze our raw access logs for potential FastJson exploit attempts. This looks for the tell-tale AutoType signature:

import re

def scan_for_fast(log_file_path):
    # Regex to find @type usage which is common in FastJson exploits
    fast_pattern = re.compile(r'"@type"\s*:\s*"')
    
    with open(log_file_path, 'r') as f:
        for line in f:
            if fast_pattern.search(line):
                print(f"Suspicious entry found: {line.strip()}")
                
# scan_for_fast('access.log')


Is anyone else seeing specific indicators of compromise (IOCs) related to this? Or are you seeing mostly scanning activity? Also, for those stuck on FastJson, have you had success with the `SafeMode` configuration or is a full library migration to Jackson/Gson the only reliable path right now?