CVE-2025-70974: Fastjson AutoType RCE Vulnerability

CVE-2025-70974 Overview

CVE-2025-70974 is a critical Insecure Deserialization vulnerability in Alibaba's Fastjson library before version 1.2.48. The vulnerability stems from improper handling of the autoType feature, where an @type key in a JSON document can specify a Java class name, potentially leading to calls to certain public methods of that class. This behavior enables JNDI (Java Naming and Directory Interface) injection attacks when an attacker can supply a malicious payload within the JSON document.

This vulnerability was actively exploited in the wild from 2023 through 2025, and exists as an incomplete fix for CVE-2017-18349. A later bypass of this vulnerability is tracked as CVE-2022-25845.

Critical Impact

This vulnerability allows unauthenticated remote attackers to achieve full remote code execution on affected systems through JNDI injection, with no user interaction required and the ability to impact resources beyond the vulnerable component's security scope.

Affected Products

• Fastjson versions before 1.2.48
• Java applications utilizing vulnerable Fastjson versions for JSON parsing
• Systems with JNDI lookup capabilities exposed through Fastjson deserialization

Discovery Timeline

• 2026-01-09 - CVE CVE-2025-70974 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-70974

Vulnerability Analysis

The vulnerability resides in Fastjson's autoType functionality, which is designed to automatically deserialize JSON into Java objects based on type information embedded in the JSON document itself. When a JSON document contains an @type key with a Java class name as its value, Fastjson instantiates that class and invokes its methods during the deserialization process.

The fundamental issue is that Fastjson performs insufficient validation on which classes can be instantiated through this mechanism. Attackers can exploit this by specifying classes that perform JNDI lookups during their instantiation or method invocation, combined with a malicious JNDI URL pointing to an attacker-controlled server hosting malicious code.

This vulnerability has been associated with malware campaigns, including the Androxgh0st botnet, which has actively targeted vulnerable Fastjson deployments.

Root Cause

The root cause is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Fastjson's autoType feature allows untrusted JSON input to control which Java classes are instantiated during deserialization. The library's blocklist-based approach to preventing dangerous class instantiation proved insufficient, as attackers discovered bypass techniques that circumvented the protections implemented after CVE-2017-18349.

The incomplete nature of the original fix meant that alternative class paths and naming conventions could still reach dangerous functionality, ultimately enabling JNDI injection through classes not present on the blocklist.

Attack Vector

Exploitation occurs over the network without requiring authentication or user interaction. An attacker crafts a malicious JSON payload containing an @type field referencing a gadget class that performs JNDI lookups, along with properties that direct those lookups to an attacker-controlled LDAP or RMI server.

When the vulnerable application parses this JSON using Fastjson, it instantiates the specified class and triggers the JNDI lookup. The attacker's server responds with a reference to a malicious Java class, which the victim's JVM then downloads and executes, achieving remote code execution.

The attack chain typically involves: malicious JSON submission → Fastjson autoType deserialization → gadget class instantiation → JNDI lookup to attacker server → malicious class download and execution.

Technical details and reproduction steps can be found in the Vulhub Fastjson RCE Repository.

Detection Methods for CVE-2025-70974

Indicators of Compromise

• Outbound LDAP or RMI connections from application servers to unexpected external IP addresses
• JSON payloads containing @type keys with suspicious class names in application logs
• Unexpected Java class files in temporary directories or cache locations
• JNDI-related errors or warnings in application logs indicating lookup attempts

Detection Strategies

• Deploy network monitoring to detect outbound LDAP (port 389/636) and RMI (port 1099) traffic from application servers
• Implement application-level logging to capture and alert on JSON payloads containing @type fields
• Utilize web application firewalls (WAF) with rules to block requests containing Fastjson gadget class patterns
• Monitor JVM behavior for unexpected class loading from remote sources

Monitoring Recommendations

• Configure SIEM rules to correlate JSON parsing activity with subsequent outbound JNDI traffic
• Establish baseline network behavior for Java applications and alert on deviations
• Deploy endpoint detection and response (EDR) solutions to detect post-exploitation activity
• Implement Java Security Manager policies to restrict JNDI lookups where feasible

How to Mitigate CVE-2025-70974

Immediate Actions Required

• Upgrade Fastjson to version 1.2.48 or later immediately on all affected systems
• If immediate upgrade is not possible, disable autoType functionality entirely in Fastjson configuration
• Review application code to identify all Fastjson usage and prioritize remediation
• Block outbound LDAP and RMI traffic from application servers at the network perimeter

Patch Information

The fix is available in Fastjson version 1.2.48 and later. Release notes detailing the security improvements can be reviewed at the GitHub Fastjson Release Notes. Organizations should update their Maven, Gradle, or other dependency management configurations to specify version 1.2.48 or higher. For additional context, refer to the CNVD Flaw Report CNVD-2019-22238 and 360Cert Warning ID 7240.

Workarounds

• Disable autoType by setting ParserConfig.getGlobalInstance().setAutoTypeSupport(false) in application initialization code
• Implement input validation to reject JSON documents containing @type fields before passing to Fastjson
• Configure network egress filtering to block LDAP and RMI protocols from application server subnets
• Consider migrating to alternative JSON libraries such as Jackson or Gson that do not have polymorphic deserialization enabled by default

# Example: Blocking outbound JNDI traffic with iptables
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP
iptables -A OUTPUT -p tcp --dport 1099 -j DROP