Log4j2 RCE Exploit via FilteredObjectInputStream Bypass

This repository demonstrates a pre-auth Remote Code Execution (RCE) vulnerability affecting any Java service that utilizes Apache Log4j's FilteredObjectInputStream to deserialize LogEvent. No credentials are required to exploit this vulnerability.

Overview

The FilteredObjectInputStream (FOIS) is designed as a safe deserialization wrapper, enforcing an allowlist for specific classes. However, it allows the use of java.rmi.MarshalledObject, which circumvents the filtering mechanism. When a MarshalledObject is deserialized, it creates a fresh ObjectInputStream that lacks any filtering, enabling the execution of arbitrary code through malicious payloads embedded in the stream.

Mechanism of the Bypass

Log4j's design includes a LogEventProxy class that wraps the event message in MarshalledObject<Message>. During deserialization, the marshalledMessage.get() method is called, generating an unfiltered stream from the MarshalledObject, thus exposing the application to the attack without logging or errors. The exploit triggers a command execution via a gadget chain hidden within the MarshalledObject.objBytes.

Attack Flow

The attack is facilitated through the following flow:

1. The attacker sends a serialized LogEventProxy via an HTTP POST request to the target service.
2. The FOIS processes the input, revealing no filtering on the key classes – LogEventProxy, MarshalledObject, and the primitive byte[].
3. The command execution occurs when LogEventProxy.readResolve() accesses the unfiltered input stream from the marshalledMessage and triggers the gadget chain that leads to remote code execution.

Payload Construction

To exploit this vulnerability, a payload and a specific message type called GadgetMessage are formed. This technique involves configuring the gadget correctly inside the marshal object while avoiding early triggers. The steps include:

• Building a Log4jLogEvent that encapsulates the GadgetMessage.
• Serializing the event, leading to the construction of a malicious payload that will be sent to the target.

Affected Versions

The vulnerability affects the following Log4j components:

Instructions for Exploitation

To demonstrate the exploit, the following setup is required:

• Java 11+, Maven, Python 3.10+, and Docker (for the victim lab).

The repository includes a victim Docker setup and an exploitation script. Instructions for building and running the victim service, as well as executing the exploit, are provided.

Caution

This exploit is intended solely for authorized testing. Ensure to obtain written permission before executing the payload against any systems.