Help Center> Web Application Firewall> User Guide (Paris) > Best Practices> Mitigating Web Security Vulnerabilities> Remote Code Execution Vulnerability of Fastjson
Updated on 2024-03-14 GMT+08:00
View PDF

Remote Code Execution Vulnerability of Fastjson

On July 12, 2019, the Emergency Response Center detected that the open-source component Fastjson had a remote code execution vulnerability. This vulnerability is an extension of the deserialization vulnerability of Fastjson 1.2.24 detected in 2017 and can be directly used to obtain server permissions, causing serious damage.

Affected Versions

Versions earlier than Fastjson 1.2.51

Mitigation Version

Fastjson 1.2.51 or later

Official Solution

Upgrade Fastjson to 1.2.51 or the latest 1.2.58 version.

Mitigation

The built-in protection rules of WAF can defend against this vulnerability. The procedure is as follows:

  1. Apply for a dedicated WAF instance.
  2. Add the website domain name to WAF and route website traffic to WAF.

  3. Set the mode of Basic Web Protection to Block. For details, see Configuring Basic Protection Rules to Defend Against Common Web Attacks.