Spring Boot Fat-JARs Stay Exposed After Fastjson Bypass
The dangerous assumption is that turning off AutoType makes Fastjson safe. In Spring Boot fat-JAR deployments, a reachable JSON parser can still be driven into unauthenticated code execution with the Java process's privileges, and there is no fixed Fastjson 1.x release yet.
The flaw affects Fastjson 1.2.68 through 1.2.83 and has already shown up in real attacks. Alibaba says SafeMode is off by default, and the confirmed path works even with AutoType disabled and no classpath gadget, which is why patching to a simple 1.x fix is not an option today.
For teams that still run legacy Spring Boot fat-JAR services, the trust boundary is wrong: a parser meant to read data can become a code-loading path. That makes internet-facing JSON endpoints a live execution surface until the library is hardened or replaced.