Help Center/ Web Application Firewall/ User Guide (Paris) / Best Practices/ Mitigating Web Security Vulnerabilities/ DoS Vulnerability in the Open-Source Component Fastjson
Updated on 2024-03-14 GMT+08:00
View PDF
Share

DoS Vulnerability in the Open-Source Component Fastjson

On September 3, 2019, the security team detected a DoS vulnerability in multiple versions of the widely used open-source component Fastjson. An attacker can exploit this vulnerability to construct malicious requests and send them to the server that uses Fastjson. As a result, the memory and CPU of the server are used up, and the server breaks down, causing service breakdown. WAF provides protection against this vulnerability.

Affected Versions

Versions earlier than Fastjson 1.2.60

Mitigation Version

Fastjson 1.2.60

Official Solution

Upgrade the open-source component Fastjson to 1.2.60.

Mitigation

WAF can detect and defend against this vulnerability. The procedure is as follows:

  1. Apply for a dedicated WAF instance.
  2. Add the website domain name to WAF and route website traffic to WAF.

  3. Set the mode of Basic Web Protection to Block. For details, see Configuring Basic Protection Rules to Defend Against Common Web Attacks.