How I Use a JSON 0-Day to Steal Your Money on the Blockchain
Hao Xing and Zekai Wu disclose a universal zero-day deserialization bypass in Fastjson, exploiting Java web services to execute RCE and drain crypto nodes.
Summary
The Proliferation of Fastjson in Enterprise and Blockchain Services
With over 23,000 GitHub stars, Fastjson is one of the most widely deployed open-source JSON parsers in Java web services and cryptocurrency exchange backends.
Bypassing Modern Fastjson SafeMode and Deserialization Blacklists
Hao Xing and Zekai Wu uncover novel class inheritance chains that completely circumvent Fastjson's security checks and AutoType restrictions.
Achieving Unauthenticated Remote Code Execution
Submitting crafted JSON payloads allows an attacker to instantiate dangerous Java gadget chains, achieving full remote code execution on target servers.
Targeting Blockchain Gateways and Remediation
The researchers demonstrate real-world attacks against cryptocurrency wallet services and coordinate upstream patches with the Alibaba Fastjson team.
Related talks
Main Stage·35 min
Jonathan Birch
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.
Main Stage·43 min
Yuhao Weng · Steven Seeley · Zhiniang Peng
Star-V Lab researchers take a deep dive into Microsoft SharePoint Server, chaining multiple zero-day vulnerabilities to achieve unauthenticated remote code execution.
Black Hat·40 min
Industry experts analyze emerging threats surrounding How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain.