Kirill Firsov on X: "We found a gadget-free RCE in Fastjson 1.2.83 - the final release of the 1.x line, and still one of the most widely-deployed Java JSON libraries in production today, even with 2.x around.<br>No classpath gadget. One payload-> RCE. https://t.co/8pbjl1M8y7" / X<br>Post
Log inSign up
Post
Kirill Firsov
@k_firsov
We found a gadget-free RCE in Fastjson 1.2.83 - the final release of the 1.x line, and still one of the most widely-deployed Java JSON libraries in production today, even with 2.x around.<br>No classpath gadget. One payload-> RCE.
00:00
span:not(:empty)~span:not(:empty)]:before:content-['·'] [&>span:not(:empty)~span:not(:empty)]:before:px-1 [&>span:not(:empty)~span:not(:empty)]:before:shrink-0">3:59 PM · Jul 19, 202635.1KViews
30030<br>61061<br>3290329<br>1390139
Read 30 replies
New to X?<br>Sign up now to get your own personalized timeline!<br>Sign up with GoogleSign up with AppleCreate account<br>By signing up, you agree to the Terms of Service and Privacy Policy, including Cookie Use.
Relevant people<br>Kirill Firsov@k_firsovFollow
Don't miss what's happening<br>People on X are the first to know.
Log inSign up
Trending now