├── src
    └── main
    │   ├── resources
    │       ├── application.properties
    │       └── templates
    │       │   └── index.html
    │   └── java
    │       └── com
    │           └── github
    │               └── isafeblue
    │                   └── fastjson
    │                       ├── FastjsonAutotypeBypassDemoApplication.java
    │                       ├── entity
    │                           └── Comment.java
    │                       └── controller
    │                           └── CommentController.java
├── README.md
└── pom.xml


/src/main/resources/application.properties:
--------------------------------------------------------------------------------
1 | server.port=80


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # fastjson-autotype-bypass-demo
2 | fastjson 1.2.68 版本有限制autotype bypass
3 | 
4 | # 参考
5 | 
6 | 《fastjson 1.2.68 autotype bypass 反序列化漏洞 gadget 的一种挖掘思路》:https://b1ue.cn/archives/382.html
7 | 
8 | 《fastjson 1.2.68 最新版本有限制 autotype bypass》:https://b1ue.cn/archives/348.html
9 | 


--------------------------------------------------------------------------------
/src/main/java/com/github/isafeblue/fastjson/FastjsonAutotypeBypassDemoApplication.java:
--------------------------------------------------------------------------------
 1 | package com.github.isafeblue.fastjson;
 2 | 
 3 | import org.springframework.boot.SpringApplication;
 4 | import org.springframework.boot.autoconfigure.SpringBootApplication;
 5 | 
 6 | @SpringBootApplication
 7 | public class FastjsonAutotypeBypassDemoApplication {
 8 | 
 9 | 	public static void main(String[] args) {
10 | 		SpringApplication.run(FastjsonAutotypeBypassDemoApplication.class, args);
11 | 	}
12 | 
13 | }
14 | 


--------------------------------------------------------------------------------
/src/main/java/com/github/isafeblue/fastjson/entity/Comment.java:
--------------------------------------------------------------------------------
 1 | package com.github.isafeblue.fastjson.entity;
 2 | 
 3 | /**
 4 |  * @author 浅蓝
 5 |  * @email blue@ixsec.org
 6 |  * @since 2020/5/9 12:58
 7 |  */
 8 | public class Comment {
 9 | 
10 |     private String name;
11 |     private String email;
12 |     private String content;
13 | 
14 |     public String getName() {
15 |         return name;
16 |     }
17 | 
18 |     public void setName(String name) {
19 |         this.name = name;
20 |     }
21 | 
22 |     public String getEmail() {
23 |         return email;
24 |     }
25 | 
26 |     public void setEmail(String email) {
27 |         this.email = email;
28 |     }
29 | 
30 |     public String getContent() {
31 |         return content;
32 |     }
33 | 
34 |     public void setContent(String content) {
35 |         this.content = content;
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 3 | 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 4 | 	<modelVersion>4.0.0</modelVersion>
 5 | 	<parent>
 6 | 		<groupId>org.springframework.boot</groupId>
 7 | 		<artifactId>spring-boot-starter-parent</artifactId>
 8 | 		<version>2.2.7.RELEASE</version>
 9 | 		<relativePath/> <!-- lookup parent from repository -->
10 | 	</parent>
11 | 	<groupId>com.github.iSafeBlue</groupId>
12 | 	<artifactId>fastjson-autotype-bypass-demo</artifactId>
13 | 	<version>0.0.1-SNAPSHOT</version>
14 | 	<name>fastjson-autotype-bypass-demo</name>
15 | 	<description>fastjson-autotype-bypass-demo</description>
16 | 
17 | 	<properties>
18 | 		<java.version>1.8</java.version>
19 | 	</properties>
20 | 
21 | 	<dependencies>
22 | 
23 | 		<dependency>
24 | 			<groupId>com.alibaba</groupId>
25 | 			<artifactId>fastjson</artifactId>
26 | 			<version>1.2.68</version>
27 | 		</dependency>
28 | 
29 | 		<dependency>
30 | 			<groupId>org.seleniumhq.selenium</groupId>
31 | 			<artifactId>selenium-api</artifactId>
32 | 			<version>3.141.59</version>
33 | 		</dependency>
34 | 
35 | 
36 | 		<dependency>
37 | 			<groupId>org.springframework.boot</groupId>
38 | 			<artifactId>spring-boot-starter-web</artifactId>
39 | 		</dependency>
40 | 		<dependency>
41 | 			<groupId>org.springframework.boot</groupId>
42 | 			<artifactId>spring-boot-starter-thymeleaf</artifactId>
43 | 		</dependency>
44 | 	</dependencies>
45 | 
46 | 	<build>
47 | 		<plugins>
48 | 			<plugin>
49 | 				<groupId>org.springframework.boot</groupId>
50 | 				<artifactId>spring-boot-maven-plugin</artifactId>
51 | 			</plugin>
52 | 		</plugins>
53 | 	</build>
54 | 
55 | </project>
56 | 


--------------------------------------------------------------------------------
/src/main/resources/templates/index.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en" xmlns:th="http://www.w3.org/1999/xhtml">
 3 | <head>
 4 |     <meta charset="UTF-8">
 5 |     <title>Hello World</title>
 6 |     <script src="http://cdn.bootcdn.net/ajax/libs/jquery/3.5.0/jquery.min.js"></script>
 7 |     <script>
 8 | 
 9 |         $(function () {
10 |             $("#button").click(function () {
11 |                 $.ajax({
12 |                     url:"addComment",
13 |                     type:"post",
14 |                     contentType: "application/json; charset=utf-8",
15 |                     data: JSON.stringify({name:$("#name").val(),email:$("#email").val(),content:$("#content").val()}),
16 |                     success:function (data) {
17 |                         location.reload()
18 |                     }
19 |                 });
20 | 
21 |             });
22 |         })
23 | 
24 |     </script>
25 | </head>
26 | <body>
27 | 
28 | 
29 |     <table >
30 |         <thead>
31 |         <th>序号</th>
32 |         <th>姓名</th>
33 |         <th>邮箱</th>
34 |         <th>留言</th>
35 |         </thead>
36 |         <tbody>
37 |         <tr th:each="entries,stat:${comments}" >
38 |             <td th:text="${stat.count}"></td>
39 |             <td th:text="${entries.name}"></td>
40 |             <td th:text="${entries.email}"></td>
41 |             <td th:text="${entries.content}"></td>
42 |         </tr>
43 |         </tbody>
44 |     </table>
45 | 
46 | 
47 |     <hr>
48 | 
49 | 
50 |     <form id="form">
51 |         <input type="text" name="name" id="name" placeholder="姓名"><br/>
52 |         <input type="text" name="email" id="email" placeholder="邮箱"><br/>
53 |         <textarea name="content" id="content" placeholder="留言内容"></textarea><br>
54 |         <input type="button" id="button" value="提交"/>
55 |     </form>
56 | 
57 | </body>
58 | </html>


--------------------------------------------------------------------------------
/src/main/java/com/github/isafeblue/fastjson/controller/CommentController.java:
--------------------------------------------------------------------------------
 1 | package com.github.isafeblue.fastjson.controller;
 2 | 
 3 | import com.alibaba.fastjson.JSON;
 4 | import com.alibaba.fastjson.JSONObject;
 5 | import com.alibaba.fastjson.parser.ParserConfig;
 6 | import com.github.isafeblue.fastjson.entity.Comment;
 7 | import org.springframework.stereotype.Controller;
 8 | import org.springframework.web.bind.annotation.RequestBody;
 9 | import org.springframework.web.bind.annotation.RequestMapping;
10 | import org.springframework.web.bind.annotation.ResponseBody;
11 | import org.springframework.web.servlet.ModelAndView;
12 | 
13 | import java.util.ArrayList;
14 | import java.util.List;
15 | 
16 | /**
17 |  * @author 浅蓝
18 |  * @email blue@ixsec.org
19 |  * @since 2020/5/9 12:56
20 |  */
21 | @Controller
22 | public class CommentController {
23 | 
24 | 
25 |     public static List<Comment>  comments = new ArrayList(){
26 |         {
27 |             Comment comment = new Comment();
28 |             comment.setName("Tom");
29 |             comment.setContent("Hello World.");
30 |             comment.setEmail("tom@gmail.com");
31 |             add(comment);
32 |         }
33 |     };
34 | 
35 |     @RequestMapping("/")
36 |     public ModelAndView index(){
37 |         ModelAndView modelAndView = new ModelAndView();
38 |         modelAndView.setViewName("index.html");
39 |         modelAndView.addObject("comments",comments);
40 |         return modelAndView;
41 |     }
42 | 
43 |     @RequestMapping("addComment")
44 |     @ResponseBody
45 |     public String addComment(@RequestBody String comment){
46 |         
47 |         JSONObject jsonObject = JSON.parseObject(comment);
48 |         Comment temp = new Comment();
49 |         temp.setName(jsonObject.getString("name"));
50 |         temp.setEmail(jsonObject.getString("email"));
51 |         temp.setContent(jsonObject.getString("content"));
52 |         comments.add(temp);
53 |         return "1";
54 |     }
55 | 
56 | }
57 | 


--------------------------------------------------------------------------------