CVE-2022-25845 FastJSON（com.alibaba:fastjson）

springboot 升级以及漏洞处理CVE-2022-25845 FastJSONcom.alibaba:fastjson包引发的漏洞 fastJson-1.2.68.jarcom.alibaba.fastjson.parser.ParserConfigcom.alibaba.fastjson.parser.deserializer.ThrowableDeserializerFastJSON 默认关闭 autoType防止任意类反序列化但攻击者可构造特殊 JSON 绕过该限制 外层使用 java.lang.Exception属 Throwable 家族 内层嵌入恶意类继承 Throwable 触发反序列化时绕过 checkAutoType 黑白名单加载并执行恶意类最终远程代码执行。!-- Maven 示例 -- dependency groupIdcom.alibaba/groupId artifactIdfastjson/artifactId version1.2.83/version !-- 或更高 -- /dependency换成其他的包例如Jackson !-- FastJSON2 核心 -- dependency groupIdcom.alibaba.fastjson2/groupId artifactIdfastjson2/artifactId version2.0.61/version /dependency dependency groupIdcom.fasterxml.jackson.core/groupId artifactIdjackson-core/artifactId version2.21.2/version /dependency dependency groupIdcom.fasterxml.jackson.core/groupId artifactIdjackson-annotations/artifactId version2.21.2/version /dependency dependency groupIdcom.fasterxml.jackson.core/groupId artifactIdjackson-databind/artifactId version2.21.2/version /dependency import com.fasterxml.jackson.core.*; import com.fasterxml.jackson.databind.*; import com.fasterxml.jackson.annotation.*;