search

ClouGence / hasor

Hasor是一套基于 Java 语言的开发框架，区别于其它框架的是 Hasor 有着自己一套完整的体系，同时还可以和先有技术体系做到完美融合。它包含：IoC/Aop容器框架、Web框架、Jdbc框架、RSF分布式RPC框架、DataQL引擎，等几块。
http://www.hasor.net
Apache License 2.0
983 stars 273 forks source link

Fastjson rce vuln #2

Closed xqc2000 closed 4 years ago

xqc2000 commented 6 years ago

The component FastjsonEngine converts a JSON string to an equivalent Java Object based on Fastjson(version 1.2.11); However,Fastjson version 1.2.24 and prior has a remote code execution vulnerability. for details,please refer to the links below: https://fortiguard.com/encyclopedia/ips/44059 http://xxlegend.com/2017/12/06/基于JdbcRowSetImpl的Fastjson%20RCE%20PoC构造与分析/ Upgrade to Fastjson version 1.2.45 or later can fix the issue.

zycgit commented 4 years ago

tks ,at new version Fastjson has been upgraded.