CVE-2017-18349

CRITICAL

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by...

Affects 2 products across 2 vendors.

CVSS 3.09.8
EPSS39.2%
Percentile99th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Alibaba systems (CVE-2017-18349). A proof-of-concept has been published. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-196659-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2017-18349?
This vulnerability was disclosed in 2018. A critical vulnerability affects Alibaba systems (CVE-2017-18349). A proof-of-concept has been published. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2017-18349?
CVE-2017-18349 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 39.2%.
Is CVE-2017-18349 actively exploited?
No confirmed active exploitation of CVE-2017-18349 as of 2026-09-25.
How do I remediate CVE-2017-18349?
Priority: MEDIUM.
What systems are affected by CVE-2017-18349?
CVE-2017-18349 affects Alibaba Fastjson; Pippo Pippo.
Vulnerability Details
CVE IDCVE-2017-18349
BSIDBS-2018-GLOBAL-196659-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2018-10-23
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Alibaba Fastjson < 1.2.25
Pippo Pippo 1.11.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2914 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash45c0de1e8505e43237c687486bc072f25e43cf20f81be28a564af14bbc3245bca03181986bd920a4ba04269a211ac87f07f539f33a41460fb44ccb0d78c76a8d
Related CVEs affecting Alibaba
CVE-2025-70974 10.0 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a... CVE-2022-25845 9.8 The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserializat... CVE-2021-29441 9.8 Nacos is a platform designed for dynamic service discovery and configuration ... CVE-2025-15573 9.4 The affected devices do not validate the server certificate when connecting t... CVE-2026-16723 9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through...
View all Alibaba CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →