CVE-2017-18349: RCE in Fastjson via JSON crafted

CVE-2017-18349 is a remote code execution (RCE) vulnerability in Fastjson before version 1.2.25. The flaw exists in the parseObject method which processes crafted JSON requests. Attackers exploit an rmi:// URI embedded in the dataSourceName field of an HTTP POST request to execute arbitrary code. The vulnerability affects Fastjson and products that bundle it, including FastjsonEngine in Pippo 1.11.0 and other software.

The CVSS score is 10.0, the maximum criticality level. The vulnerability was disclosed on NVD on October 23, 2018. As of November 2026, signals from GitHub repositories indicate the availability of environments and proofs of concept related to CVE-2017-18349. This is not confirmed active exploitation, but rather public signals about available research tools.

IT teams and administrators must identify all instances of Fastjson < 1.2.25 in production environments and upgrade to version 1.2.25 or later. If Pippo is in use, verify that the version number is greater than 1.11.0. Applying the official patch is the only effective mitigation; it is not advisable to download or execute exploits from public repositories. Monitor access logs to affected services to detect anomalous exploitation attempts.