# FastJSON

## FastJSON Deserialization <a href="#fastjson1224-fan-xu-lie-hua-dao-zhi-ren-yi-ming-ling-zhi-hang-lou-dong" id="fastjson1224-fan-xu-lie-hua-dao-zhi-ren-yi-ming-ling-zhi-hang-lou-dong"></a>









## Lab: Vulhub FastJSON 1.2.24 Deserialization

{% embed url="https://github.com/vulhub/vulhub/tree/master/fastjson/1.2.24-rce" %}
Vulhub
{% endembed %}

Spawn a Docker container:

```bash
cd vulhub/fastjson/1.2.24-rce
docker-compose up -d
```

The vulnerable application will be hosted on `http://localhost:8090`. The application shows the following JSON data:

```
{
	"age":25,
	"name":"Bob"
}
```

You can modify it by sending a POST request:

```bash
curl http://localhost:8090/ -H "Content-Type: application/json" --data '{"name":"hello", "age":20}'
```



## Reference

{% embed url="https://vulhub.org/#/environments/fastjson/1.2.24-rce/" %}
FastJSON 1.2.24 Deserialization - Vulhub
{% endembed %}
