—>realhackhistory.org
@bsky.realhackhistory.org
4.2K followers 1.5K following 7.2K posts
O͖̺͊̕͡ͅfficial bluesky for realhackhistory YouTube channel & blog, skeeting the #history of phreaks, #hacking & #hacktivism as well as portrayal of hackers in media. I do some threat intel & OSINT. No AI used. Hobbyist #skystorian. realhackhistory.org
![[Security] FilteredObjectinputStream allowlist bypass via java.rmi.MarshalledObject with auto-trigger during LogEvent deserialization (2.11.0-2.26.1) #4255
• Open
U-Sec opened 2d ago
Description
Reported by U-Sec (Wujie Security). Public disclosure of security vulnerabilities is not enabled on this repository, so we are reporting this through the issue tracker. If you prefer, this issue can be converted into a private discussion / advisory; we will keep full details confidential and are happy to move this report to security@logging.apache.org on request - please just confirm receipt and a tracking case number so we can coordinate.
FilteredobjectInputStream explicitly allows java.rmi.Marshalledobject in its default allowlist. A Marshalledobject carries its payload as an opaque byte[] (objBytes), so a resolveClass -based filter never inspects it. When the payload is later unwrapped, Marshalledobject.get() constructs a new plain ObjectInputStream on those bytes and deserializes it completely unfiltered.
Log4j provides the trigger itself: Log4jLogEvent .LogEventProxy serializes the event Message inside a Marshalledobject (field marshalledMessage, Since 2.8) and calls marshalledMessage.get() inside readResolve) → message) . A single serialized LogEventProxy received by any FOIS-based log receiver therefore executes attacker-controlled deserialization with zero filtering, while the receiver continues processing normally the ClassCastException from a non- Message payload is swallowed by message), which falls back to SimpleMessage(messageString) •
This means the complete Java serialization gadget catalog applies: the payload does not need to implement Message and does not need to pass the allowlist.
Configuration
Version: log4j-api 2.11.0-2.26.1/log4j-core log4j-core (verified against official 2.26.1 artifacts from Maven Central)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:2nhudqe7uplgqvnt72p2vxnb/bafkreie2zzluhwwzi7smf5d326f6uqtgtmigtqrweuolj6jknafspp2xfy)
