Apache Log4j 2.x FilteredObjectInputStream Allowlist Bypass RCE (Log4j #4255)

critical Nessus Plugin ID 341335

Synopsis

The remote host is running a Log4j TCP log receiver that is vulnerable to unauthenticated remote code execution.

Description

The remote host is running a Log4j 2 serialized-LogEvent TCP receiver (such as the ObjectInputStreamLogEventBridge sample shipped in the log4j-samples repository) that uses FilteredObjectInputStream (FOIS) for deserialization filtering.

Log4j 2 FOIS allowlists java.rmi.MarshalledObject because LogEventProxy stores the inner Message as a MarshalledObject. However, MarshalledObject.get() opens a second, UNFILTERED ObjectInputStream to read its objBytes payload, defeating the filter. An unauthenticated remote attacker who can connect to the receiver TCP port can send a specially crafted serialized LogEventProxy whose marshalledMessage embeds a CommonsCollections gadget chain. When deserialized on a receiver whose classpath includes Commons Collections <= 3.2.1, this results in arbitrary OS command execution.

Conditions required for exploitation:
- An application deploys an unauthenticated FOIS-based serialized LogEvent TCP receiver (no auth, no TLS).
- Commons Collections 3.2.1 (or earlier) is on the JVM classpath.
(CC 3.2.2 disables the unsafe functor serialization that the gadget relies on; CC 3.2.2 is NOT affected.)
- No additional jdk.serialFilter denying java.rmi.MarshalledObject or MarshalledObject descendant types.

The exploit is fire-and-forget: the receiver processes the event silently and logs 'processed event OK' even when exploited. The only reliable detection is an out-of-band callback from the target.

This plugin uses two detection stages: first, a DNS callback where the exploit command triggers a DNS lookup of a Nessus-controlled hostname;
second, a direct TCP socket callback where the target connects back to the scanner and sends a unique control token. A confirmed response from either stage proves server-side code execution.

Solution

Apply one of the following mitigations:
1. Upgrade Commons Collections to 3.2.2 or later (disables the unsafe Transformer functors).
2. Add jdk.serialFilter = '!java.rmi.MarshalledObject;...' to deny MarshalledObject deserialization entirely.
3. Remove or firewall the unauthenticated TCP log receiver.

Plugin Details

Severity: Critical

ID: 341335

File Name: apache_log4j2_4255_fois_bypass_rce.nbin

Version: 1.1

Type: Remote

Family: Misc.

Published: 8/28/2026

Updated: 8/28/2026

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:apache:log4j

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Vulnerability Publication Date: 10/1/2024

Detections

Analytics