CVE-2017-18349

CVE-2017-18349 describes a critical remote code execution vulnerability in Fastjson versions prior to 1.2.25, specifically when used with products like Pippo 1.11.0. An unauthenticated attacker can exploit this by sending a crafted JSON request containing a malicious URI, such as an rmi:// URI in the dataSourceName field, to trigger arbitrary code execution. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit intelligence indicates the existence of Nuclei templates for this vulnerability, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.