CVE-2025-70974

Estado: AplazadaCrítica (10)—

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.76%
Percentil entre todas las CVEs puntuadas: 54
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1005 Data from Local Systemcollection70 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access75 %

Red sin autenticación (AV:N/PR:N): T1190. JNDI injection permite ejecución remota de código (T1059), potencial acceso a credenciales (T1078) y exfiltración de datos sensibles (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training User Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Alibaba — Fastjson^AI

CWE

CWE-829
CWE-829

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-70974",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-70974",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-09T21:37:04.264336Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Alibaba",
          "product": "Fastjson",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.2.48",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/grafana-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/istio-cni-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/istio-must-gather-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/istio-operator-bundle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/istio-rhel8-operator",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/pilot-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/proxyv2-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "vendor": "Red Hat",
          "product": "OpenShift Service Mesh 2",
          "packageName": "openshift-service-mesh/ratelimit-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:camel_spring_boot:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel for Spring Boot 4",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:debezium:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Debezium 2",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:debezium:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat build of Debezium 3",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "packageName": "fastjson",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-09T07:16:02.677",
  "references": [
    {
      "url": "https://cert.360.cn/warning/detail?id=7240aeab581c6dc2c9c5350756079955",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/alibaba/fastjson/compare/1.2.47...1.2.48",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.47-rce",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cloudsek.com/blog/androxgh0st-continues-exploitation-operators-compromise-a-us-university-for-hosting-c2-logger",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2019-22238",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.freebuf.com/vuls/208339.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.seebug.org/vuldb/ssvid-98020",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-70974",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428203",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-70974.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845."
    },
    {
      "lang": "es",
      "value": "Fastjson anterior a 1.2.48 maneja incorrectamente autoType porque, cuando una clave @type está en un documento JSON y el valor de esa clave es el nombre de una clase Java, puede haber llamadas a ciertos métodos públicos de esa clase. Dependiendo del comportamiento de esos métodos, puede haber inyección JNDI con una carga útil proporcionada por el atacante ubicada en otra parte de ese documento JSON. Esto fue explotado en la naturaleza entre 2023 y 2025. NOTA: este problema existe debido a una corrección incompleta para CVE-2017-18349. Además, una omisión posterior está cubierta por CVE-2022-25845."
    }
  ],
  "lastModified": "2026-07-15T02:17:53.700",
  "sourceIdentifier": "cve@mitre.org"
}