Skip to content
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
github.com | vulnerability | Critical | #rce | #public-poc | #java | #deserialization | #pre-auth | #authentication | #vulnerability | #log4j | #apache | #commons-collections | #serialization | #poc | #filteredobjectinputstream | #marshalledobject
Summary
Pre-auth RCE on Java services deserializing LogEvent: Log4j's FOIS allowlist falls to LogEventProxy's MarshalledObject, whose .get() opens an unfiltered stream, executing hidden CC6 gadget chains.
Why it matters
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
- Vendor
- Apache
- Product
- Log4j 2
- Affected versions
- log4j-api 2.11.0–2.24.3, log4j-core 2.8.0–2.24.3
- CVSS
- 9.8
- Published
- Collected