CVE-2025-70974

Katalog CVE

CVSS 10.0 · Critical EPSS 0,76%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere. Skor CVSS 3.1 10.0 (Critical) menurut mitre.org.

Deskripsi (NVD)

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

Rincian

Terbit di NVD

9 Januari 2026

Terakhir diubah

15 Juli 2026

Status NVD

Deferred

CVSS 3.1

10.0 (Critical), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 53,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955
• https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48
• https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce
• https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-host...
• https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238
• https://www.freebuf.com/vuls/208339.html
• https://www.seebug.org/vuldb/ssvid-98020
• https://access.redhat.com/security/cve/CVE-2025-70974
• https://bugzilla.redhat.com/show_bug.cgi?id=2428203
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-70974.json