{
  "schema_version": 1,
  "records": [
    {
      "schema_version": 1,
      "id": "503a278f-6afb-4379-9929-d2a526d61a1d",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Log4j2 2.26.1 FOIS MarshalledObject allowlist bypass: attacker-selected gadget readObject executes via LogEventProxy auto-trigger",
      "summary": "java.rmi.MarshalledObject is in the FilteredObjectInputStream default allowlist (SerializationUtil.REQUIRED_JAVA_CLASSES). Log4jLogEvent.LogEventProxy carries the event Message as a MarshalledObject and auto-unwraps it via marshalledMessage.get() (plain ObjectInputStream, no filter) during readResolve(). A single serialized LogEventProxy written to the samples-style TCP log receiver (FilteredObjectInputStream(socket.getInputStream()).readObject()) therefore executes attacker-chosen deserialization callbacks with zero filtering; control run shows the same gadget class sent unwrapped is rejected with InvalidObjectException.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api 2.26.1 / log4j-core 2.26.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "OpenJDK 25.0.4",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "build",
          "description": "Receiver JVM has log4j-api and log4j-core 2.26.1 (any 2.11.0-2.26.1 / 2.8.0-2.26.1) on the classpath and deserializes attacker bytes via FilteredObjectInputStream.readObject()"
        },
        {
          "kind": "configuration",
          "description": "For OS-command RCE, a deserialization gadget library (commons-collections 3.2.1 demonstrated) must be on the receiver classpath; without it, arbitrary class deserialization of receiver-loadable classes is still achieved"
        },
        {
          "kind": "mitigation",
          "description": "No global JEP 290 jdk.serialFilter rejecting java.rmi.MarshalledObject (default JDK configuration has none)"
        },
        {
          "kind": "network",
          "description": "Attacker can open a TCP connection to the serialized-log receiver port (binds 0.0.0.0, no authentication)"
        }
      ],
      "evidence": [
        {
          "path": "logs/receiver_tier1.log",
          "kind": "runtime_log",
          "sha256": "5ea0ab3a17667090ea2c210619871826c7f005088dfff89b8522be82a32d74d0"
        },
        {
          "path": "logs/tier1_marker.txt",
          "kind": "marker_output"
        },
        {
          "path": "logs/receiver_tier2_p1.log",
          "kind": "runtime_log",
          "sha256": "bb2b4c91c85b59c7eca5f4c36bfc666fd2827b7c359ea888dade2775e203dfee"
        },
        {
          "path": "logs/tier2_rce_marker_p1.txt",
          "kind": "marker_output",
          "sha256": "4b599500c63f322924a70187222acd30641a1adb013c7804c3a90682836bb06b"
        },
        {
          "path": "logs/receiver_control.log",
          "kind": "negative_control",
          "sha256": "d0e28e7eeb9da7b6b276631232044dcf400442fd6da7101f5ea033e122011c2a"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "control_flow_influence",
          "details": {
            "target_control": {
              "control": "full"
            },
            "trigger": "Attacker sends one serialized org.apache.logging.log4j.core.impl.Log4jLogEvent over TCP to the FilteredObjectInputStream-based receiver; LogEventProxy.writeReplace/readResolve auto-invokes MarshalledObject.get() on attacker-controlled bytes with a filterless ObjectInputStream, executing any attacker-chosen readObject()/gadget chain loadable by the receiver classpath",
            "repeatable": true
          }
        }
      },
      "fingerprint": "eb9ca3b2562251df5de50cb3e44f9e9550ebeaaa3a9008773ccc982658626e3a",
      "created_at": "2026-08-26T08:51:51.898154Z",
      "updated_at": "2026-08-26T08:51:51.898154Z"
    },
    {
      "schema_version": 1,
      "id": "eb1e9681-888b-45cd-864a-a5a69771aab2",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Remote unauthenticated OS command execution via Log4j2 FilteredObjectInputStream MarshalledObject bypass (CC6 chain over TCP serialized log receiver)",
      "summary": "Repeated remote command execution against fresh Log4j2 2.26.1 serialized-socket receiver JVMs: a single serialized Log4jLogEvent whose LogEventProxy carries a MarshalledObject-wrapped commons-collections CC6 chain triggers Runtime.exec of an attacker-chosen OS command inside the receiver JVM, writing unique single-line marker files. Negative control: identical attacker procedure against a receiver started with -Djdk.serialFilter='!java.rmi.MarshalledObject' reaches the target path but the payload is rejected (InvalidClassException: filter status: REJECTED) and no marker is created.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api 2.26.1 / log4j-core 2.26.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "OpenJDK 25.0.4",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "build",
          "description": "Receiver runs log4j-api/log4j-core 2.26.1 and accepts serialized LogEvents over an unauthenticated TCP socket wrapped in FilteredObjectInputStream"
        },
        {
          "kind": "configuration",
          "description": "commons-collections 3.2.1 (or another gadget library) present on the receiver classpath for the Runtime.exec chain"
        },
        {
          "kind": "mitigation",
          "description": "No jdk.serialFilter/JEP 290 global filter rejecting java.rmi.MarshalledObject (default)"
        },
        {
          "kind": "network",
          "description": "Attacker can reach the receiver TCP port"
        }
      ],
      "evidence": [
        {
          "path": "logs/tier2_rce_marker_q1.txt",
          "kind": "marker_output",
          "sha256": "3ca629063ab1579e712bceb05f27736d97d9ac55dbdbe91efb50b575fcd106d8"
        },
        {
          "path": "logs/tier2_rce_marker_q2.txt",
          "kind": "marker_output",
          "sha256": "a0322f4fd066451916f9b73ff4ab3f7a40f1fcd64ac8e55b8614609243eb436a"
        },
        {
          "path": "logs/receiver_tier2_q1.log",
          "kind": "runtime_log",
          "sha256": "07eed0c2666e02409f783be3e664c276c890d3377b3d073c3331e8ed4dc30b33"
        },
        {
          "path": "logs/receiver_tier2_q2.log",
          "kind": "runtime_log",
          "sha256": "35e773950fdecdfadb4720332fa013b2810d4dc6baa76e12d5bba4eeda585f43"
        },
        {
          "path": "logs/negative_control_observation.json",
          "kind": "negative_control",
          "sha256": "ffd602cb9a2bf681cdd8d5190814864f31cff6461f248e462b8abcfdedcc028e"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_repeated",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": []
      },
      "body": {
        "record_type": "derived_capability",
        "record": {
          "type": "command_execution",
          "details": {
            "attestation": "generic_runtime",
            "component_primitive_ids": [
              "503a278f-6afb-4379-9929-d2a526d61a1d"
            ],
            "process_samples": [
              {
                "process_instance": "receiver-q1",
                "marker": "PWNED-TIER2 tier2_rce_marker_q1.txt uid=1000 gid=1000",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_q1.txt",
                  "kind": "marker_output",
                  "sha256": "3ca629063ab1579e712bceb05f27736d97d9ac55dbdbe91efb50b575fcd106d8"
                }
              },
              {
                "process_instance": "receiver-q2",
                "marker": "PWNED-TIER2 tier2_rce_marker_q2.txt uid=1000 gid=1000",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_q2.txt",
                  "kind": "marker_output",
                  "sha256": "a0322f4fd066451916f9b73ff4ab3f7a40f1fcd64ac8e55b8614609243eb436a"
                }
              }
            ],
            "negative_control": {
              "process_instance": "receiver-mitigation-pneg",
              "marker": "PWNED-TIER2 marker=tier1_marker_neg2.txt",
              "observation_evidence": {
                "path": "logs/negative_control_observation.json",
                "kind": "negative_control",
                "sha256": "ffd602cb9a2bf681cdd8d5190814864f31cff6461f248e462b8abcfdedcc028e"
              }
            },
            "composition_evidence": [
              {
                "path": "logs/receiver_tier2_q1.log",
                "kind": "runtime_log",
                "sha256": "07eed0c2666e02409f783be3e664c276c890d3377b3d073c3331e8ed4dc30b33"
              },
              {
                "path": "logs/receiver_tier2_q2.log",
                "kind": "runtime_log",
                "sha256": "35e773950fdecdfadb4720332fa013b2810d4dc6baa76e12d5bba4eeda585f43"
              },
              {
                "path": "logs/receiver_neg2.log",
                "kind": "runtime_log",
                "sha256": "8c26ce1b645525ca00514b7d9b26edfa73b8916d807dccabbbb3e4faa2ead422"
              }
            ]
          }
        }
      },
      "fingerprint": "34139cd72f53416d1a62c51a017c6a3d0b50e9d94a9a3952fe9bf3b675d598d6",
      "created_at": "2026-08-26T08:53:43.893547Z",
      "updated_at": "2026-08-26T08:53:43.893547Z"
    },
    {
      "schema_version": 1,
      "id": "effc64fb-2bae-47cc-b698-9e6dc69624b2",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Log4j2 FOIS MarshalledObject bypass: attacker-controlled unfiltered deserialization via real TcpSocketServer receiver",
      "summary": "MarshalledObject-wrapped LogEventProxy sent to the real samples TcpSocketServer/ObjectInputStreamLogEventBridge receiver bypasses the FilteredObjectInputStream allowlist: MarshalledObject.get() runs a filterless ObjectInputStream over attacker bytes, executing attacker-chosen deserialization callbacks (tier1 gadget marker x2) and a commons-collections CC6 chain -> Runtime.exec (tier2 uid marker x2). Control attempt without the wrapper is rejected by FOIS; patched log4j-api (MarshalledObject removed from REQUIRED_JAVA_CLASSES) rejects the payload.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api/log4j-core 2.26.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "OpenJDK 25.0.4",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [],
      "evidence": [
        {
          "path": "logs/tier2_rce_marker_a1.txt",
          "kind": "marker_output",
          "sha256": "01c2c3d6a77485d5605efdbaa1f5a8110fc16e9706ef85aff123aeb0ae064b61"
        },
        {
          "path": "logs/tier2_rce_marker_a2.txt",
          "kind": "marker_output",
          "sha256": "eeab343f3c6f3cdcb6485d753ee0a4854874ce74fe9a15bf685714face3aa828"
        },
        {
          "path": "logs/receiver_tier2_a1.log",
          "kind": "runtime_log",
          "sha256": "8d076e4c36f2e1e9ba0550044b81e050c399aee3751bb856a71cbdbcf6cd1d13"
        },
        {
          "path": "logs/receiver_control.log",
          "kind": "runtime_log",
          "sha256": "6f7b6f84d58e38da5178e6e13362d977242ed5b51d8c4ea60bdbd824ebdb1b79"
        },
        {
          "path": "logs/tier1_marker_a1.txt",
          "kind": "marker_output",
          "sha256": "c38af201c1da4331294f30faddd89484529349e353a9515305ab6374e4fd0c2e"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": [
          "eb1e9681-888b-45cd-864a-a5a69771aab2"
        ]
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "control_flow_influence",
          "details": {
            "target_control": {
              "control": "full"
            },
            "trigger": "Single serialized Log4jLogEvent (LogEventProxy with marshalledMessage=MarshalledObject wrapping a gadget graph) written to the TCP socket of the real org.apache.logging.log4j.server.TcpSocketServer receiver; LogEventProxy.readResolve()->message()->MarshalledObject.get() deserializes the inner graph with a filterless ObjectInputStream, executing attacker-chosen readObject callbacks / gadget chains (commons-collections CC6 -> Runtime.exec)",
            "repeatable": true
          }
        }
      },
      "fingerprint": "ac66c5f860a58f2a2fcecf515dcd9d70d41b3bb0dad2f9618b95ccdfa7935452",
      "created_at": "2026-08-26T09:19:49.999231Z",
      "updated_at": "2026-08-26T09:19:49.999231Z"
    },
    {
      "schema_version": 1,
      "id": "45b938bb-2f4b-41d2-97b6-54b001ba6418",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Log4j2 serialized-socket receiver RCE via MarshalledObject FOIS bypass (real TcpSocketServer, log4j 2.26.1)",
      "summary": "Remote unauthenticated OS command execution against the real org.apache.logging.log4j.server.TcpSocketServer receiver (apache/logging-log4j-samples @ 672a155, official log4j-api/core 2.26.1 jars) by sending one serialized LogEventProxy whose MarshalledObject wraps a commons-collections CC6 chain; Runtime.exec marker captured in two fresh receiver JVMs, and the identical payload is rejected (no marker) by the line-accurate fixed log4j-api build in the negative control.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api/log4j-core 2.26.1",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "runtime": "OpenJDK 25.0.4",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "build",
          "description": "log4j-api 2.11.0-2.26.1 (MarshalledObject present in SerializationUtil.REQUIRED_JAVA_CLASSES); fixed patch removing it blocks the chain"
        },
        {
          "kind": "network",
          "description": "Receiver is the FOIS-based serialized-socket log receiver (log4j-samples TcpSocketServer + ObjectInputStreamLogEventBridge) listening on an attacker-reachable TCP port without authentication"
        },
        {
          "kind": "runtime",
          "description": "Receiver classpath contains a gadget library (commons-collections 3.2.1) providing the CC6 chain classes"
        }
      ],
      "evidence": [
        {
          "path": "logs/tier2_rce_marker_a1.txt",
          "kind": "marker_output",
          "sha256": "01c2c3d6a77485d5605efdbaa1f5a8110fc16e9706ef85aff123aeb0ae064b61"
        },
        {
          "path": "logs/tier2_rce_marker_a2.txt",
          "kind": "marker_output",
          "sha256": "eeab343f3c6f3cdcb6485d753ee0a4854874ce74fe9a15bf685714face3aa828"
        },
        {
          "path": "logs/receiver_tier2_a1.log",
          "kind": "runtime_log",
          "sha256": "8d076e4c36f2e1e9ba0550044b81e050c399aee3751bb856a71cbdbcf6cd1d13"
        },
        {
          "path": "logs/receiver_tier2_a2.log",
          "kind": "runtime_log",
          "sha256": "d88d1aa2a92b3442efeb07c165411581c51b2f11f4f42312abbb7c114dc365a7"
        },
        {
          "path": "logs/receiver_fixed_a1.log",
          "kind": "negative_control",
          "sha256": "00a752feb5831fd7d29e5ef6e0362d7720c982fc246a4521fabc1e4c8169e3bf"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_repeated",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": [
          "503a278f-6afb-4379-9929-d2a526d61a1d"
        ]
      },
      "body": {
        "record_type": "derived_capability",
        "record": {
          "type": "command_execution",
          "details": {
            "attestation": "generic_runtime",
            "component_primitive_ids": [
              "effc64fb-2bae-47cc-b698-9e6dc69624b2"
            ],
            "process_samples": [
              {
                "process_instance": "vulnerable-tier2-a1",
                "marker": "uid=1000(vscode) gid=1000(vscode) groups=1000(vscode) PWNED-TIER2 marker=tier2_rce_marker_a1.txt",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_a1.txt",
                  "kind": "marker_output",
                  "sha256": "01c2c3d6a77485d5605efdbaa1f5a8110fc16e9706ef85aff123aeb0ae064b61"
                }
              },
              {
                "process_instance": "vulnerable-tier2-a2",
                "marker": "uid=1000(vscode) gid=1000(vscode) groups=1000(vscode) PWNED-TIER2 marker=tier2_rce_marker_a2.txt",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_a2.txt",
                  "kind": "marker_output",
                  "sha256": "eeab343f3c6f3cdcb6485d753ee0a4854874ce74fe9a15bf685714face3aa828"
                }
              }
            ],
            "negative_control": {
              "process_instance": "fixed-a1",
              "marker": "PWNED-TIER2-FIXED-A1",
              "observation_evidence": {
                "path": "logs/receiver_fixed_a1.log",
                "kind": "negative_control",
                "sha256": "00a752feb5831fd7d29e5ef6e0362d7720c982fc246a4521fabc1e4c8169e3bf"
              }
            },
            "composition_evidence": [
              {
                "path": "logs/receiver_tier2_a1.log",
                "kind": "runtime_log",
                "sha256": "8d076e4c36f2e1e9ba0550044b81e050c399aee3751bb856a71cbdbcf6cd1d13"
              },
              {
                "path": "logs/receiver_tier2_a2.log",
                "kind": "runtime_log",
                "sha256": "d88d1aa2a92b3442efeb07c165411581c51b2f11f4f42312abbb7c114dc365a7"
              },
              {
                "path": "logs/sender_tier2_a1.log",
                "kind": "request",
                "sha256": "0de28a10e3193cc9efb0aa1d8a0df3a5b2e68ca3923a4e4088b4eb7b9c2bd587"
              },
              {
                "path": "logs/receiver_fixed_a1.log",
                "kind": "response",
                "sha256": "00a752feb5831fd7d29e5ef6e0362d7720c982fc246a4521fabc1e4c8169e3bf"
              }
            ]
          }
        }
      },
      "fingerprint": "9955f6393c9251cafbc45d8e77746228ee4f67c19115e765e80ceffe5ac9b7ec",
      "created_at": "2026-08-26T09:21:09.831874Z",
      "updated_at": "2026-08-26T09:21:09.831874Z"
    },
    {
      "schema_version": 1,
      "id": "b2f4af97-08fe-4f59-bfe8-715cac578974",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Log4j2 FOIS MarshalledObject bypass controls inner deserialization through real TcpSocketServer",
      "summary": "Fresh production-path validation: one exact serialized payload traversed the real Apache TcpSocketServer and ObjectInputStreamLogEventBridge in two receiver JVMs, bypassed FOIS through MarshalledObject.get(), and selected a receiver-side Runtime.exec chain. Two patched controls reached the same TCP/readObject path but rejected MarshalledObject and created no marker.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api/log4j-core 2.26.1; logging-log4j-samples entrypoint 672a1555c7f5670e7affcc7b9984a90b492eb322",
        "build_id": "7310f18dd2601851bcc37b1963906cbd86f417a18b196251c8fe64a6b3b18673",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "operating_system": "Linux with OpenJDK 25.0.4+7-1-26.04-Ubuntu",
        "runtime": "OpenJDK 25.0.4+7-1-26.04-Ubuntu",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "build",
          "description": "Receiver uses official Log4j API/Core 2.26.1 and Apache logging-log4j-samples TcpSocketServer/ObjectInputStreamLogEventBridge at commit 672a1555c7f5670e7affcc7b9984a90b492eb322"
        },
        {
          "kind": "configuration",
          "description": "Commons Collections 3.2.1 is present on the receiver classpath for the demonstrated CC6 Runtime.exec chain"
        },
        {
          "kind": "mitigation",
          "description": "No process-wide serial filter rejecting java.rmi.MarshalledObject is active"
        },
        {
          "kind": "network",
          "description": "Attacker can connect to the serialized-event TCP receiver port"
        }
      ],
      "evidence": [
        {
          "path": "logs/receiver_tier2_a1.log",
          "kind": "runtime_log",
          "sha256": "79d75da6cdaf618156104d12314b498476ea4554866c21ec73d0b4026786643d"
        },
        {
          "path": "logs/receiver_tier2_a2.log",
          "kind": "runtime_log",
          "sha256": "697810e4bdeb8583b787dc3b561ca1cc2e8fa6adfb9b0bd627762ab6e1ec8a73"
        },
        {
          "path": "logs/tier2_rce_marker_a1.txt",
          "kind": "marker_output",
          "sha256": "95bdff0fb28872baaec8492c889c7a804fef2a30ee4cbf65159d6be43651f2c2"
        },
        {
          "path": "logs/tier2_rce_marker_a2.txt",
          "kind": "marker_output",
          "sha256": "f676b4a597854dc090c9c3e56abde9e35a80a0a22270fa4d7b4ace79fa2f16e7"
        },
        {
          "path": "logs/negative_control_observation.json",
          "kind": "negative_control",
          "sha256": "8ded65200b617b4e3f9567bf8483ffbdc119bff9f97e837c195d663e0e4b9531"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_observed",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": [
          "effc64fb-2bae-47cc-b698-9e6dc69624b2",
          "503a278f-6afb-4379-9929-d2a526d61a1d"
        ]
      },
      "body": {
        "record_type": "primitive",
        "record": {
          "type": "control_flow_influence",
          "details": {
            "target_control": {
              "control": "full"
            },
            "trigger": "Replay attacker-generated serialized Log4jLogEvent.LogEventProxy bytes over TCP to Apache TcpSocketServer; ObjectInputStreamLogEventBridge invokes FOIS readObject, LogEventProxy auto-calls MarshalledObject.get(), and an inner receiver-loadable graph controls deserialization callbacks / CC6 Runtime.exec",
            "repeatable": true
          }
        }
      },
      "fingerprint": "ec4f0b5a7f3dcc1ff744298bd1eddf112c3eb3121f2541d3500ae30f527af944",
      "created_at": "2026-08-26T09:45:03.146021Z",
      "updated_at": "2026-08-26T09:45:03.146021Z"
    },
    {
      "schema_version": 1,
      "id": "9521b57c-ae9b-482d-a589-6758e03840a2",
      "org_id": "595a15be-b942-4291-b735-2763885b44ea",
      "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
      "source_run_id": "7807af7f-95c0-4c19-9cfa-8f498a6f89f7",
      "source_ticket_id": "GHSA-log4j2-4255-marshalledobject-fois-bypass",
      "title": "Remote command execution via Log4j2 FOIS MarshalledObject bypass on real TCP receiver",
      "summary": "Repeated production-path command execution: exact serialized LogEventProxy bytes crossed the real Apache TcpSocketServer TCP boundary and executed the CC6 Runtime.exec chain in two fresh receiver JVMs, producing process-unique marker lines. Identical bytes reached a distinct patched receiver but MarshalledObject was rejected and no marker was created.",
      "target": {
        "canonical_repo_url": "https://github.com/apache/logging-log4j2",
        "project_id": "a2b18981-ba46-44f8-8047-fc191b2a3731",
        "product": "apache/logging-log4j2",
        "version": "log4j-api/log4j-core 2.26.1; logging-log4j-samples entrypoint 672a1555c7f5670e7affcc7b9984a90b492eb322",
        "build_id": "7310f18dd2601851bcc37b1963906cbd86f417a18b196251c8fe64a6b3b18673",
        "architecture": "x86_64",
        "operating_system_family": "linux",
        "operating_system": "Linux with OpenJDK 25.0.4+7-1-26.04-Ubuntu",
        "runtime": "OpenJDK 25.0.4+7-1-26.04-Ubuntu",
        "mitigations": {
          "aslr": "unknown",
          "pie": "unknown",
          "nx": "unknown",
          "stack_canary": "unknown",
          "relro": "unknown"
        }
      },
      "preconditions": [
        {
          "kind": "mitigation",
          "description": "No global JEP 290 class filter rejects java.rmi.MarshalledObject"
        },
        {
          "kind": "runtime",
          "description": "Apache serialized-event TcpSocketServer is network reachable and runs vulnerable Log4j API/Core 2.26.1 with Commons Collections 3.2.1 on its classpath"
        }
      ],
      "evidence": [
        {
          "path": "logs/tier2_rce_marker_a1.txt",
          "kind": "marker_output",
          "sha256": "95bdff0fb28872baaec8492c889c7a804fef2a30ee4cbf65159d6be43651f2c2"
        },
        {
          "path": "logs/tier2_rce_marker_a2.txt",
          "kind": "marker_output",
          "sha256": "f676b4a597854dc090c9c3e56abde9e35a80a0a22270fa4d7b4ace79fa2f16e7"
        },
        {
          "path": "logs/receiver_tier2_a1.log",
          "kind": "runtime_log",
          "sha256": "79d75da6cdaf618156104d12314b498476ea4554866c21ec73d0b4026786643d"
        },
        {
          "path": "logs/receiver_tier2_a2.log",
          "kind": "runtime_log",
          "sha256": "697810e4bdeb8583b787dc3b561ca1cc2e8fa6adfb9b0bd627762ab6e1ec8a73"
        },
        {
          "path": "logs/negative_control_observation.json",
          "kind": "negative_control",
          "sha256": "8ded65200b617b4e3f9567bf8483ffbdc119bff9f97e837c195d663e0e4b9531"
        }
      ],
      "state": "observed",
      "evidence_strength": "runtime_repeated",
      "provenance": {
        "source": "run",
        "actor_worker_id": "beef-repro-kimi3",
        "derived_from_record_ids": [
          "45b938bb-2f4b-41d2-97b6-54b001ba6418",
          "eb1e9681-888b-45cd-864a-a5a69771aab2"
        ]
      },
      "body": {
        "record_type": "derived_capability",
        "record": {
          "type": "command_execution",
          "details": {
            "attestation": "generic_runtime",
            "component_primitive_ids": [
              "b2f4af97-08fe-4f59-bfe8-715cac578974"
            ],
            "process_samples": [
              {
                "process_instance": "vulnerable-tcp-receiver-a1",
                "marker": "PWNED-TIER2 token=RCE-1787737383615632389-15376 shell_pid=39677 parent_pid=39626 uid=1000(vscode) gid=1000(vscode) groups=1000(vscode)",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_a1.txt",
                  "kind": "marker_output",
                  "sha256": "95bdff0fb28872baaec8492c889c7a804fef2a30ee4cbf65159d6be43651f2c2"
                }
              },
              {
                "process_instance": "vulnerable-tcp-receiver-a2",
                "marker": "PWNED-TIER2 token=RCE-1787737383615632389-15376 shell_pid=39759 parent_pid=39708 uid=1000(vscode) gid=1000(vscode) groups=1000(vscode)",
                "marker_evidence": {
                  "path": "logs/tier2_rce_marker_a2.txt",
                  "kind": "marker_output",
                  "sha256": "f676b4a597854dc090c9c3e56abde9e35a80a0a22270fa4d7b4ace79fa2f16e7"
                }
              }
            ],
            "negative_control": {
              "process_instance": "fixed-tcp-receiver-a1",
              "marker": "PWNED-TIER2 marker intentionally absent for fixed control",
              "observation_evidence": {
                "path": "logs/negative_control_observation.json",
                "kind": "negative_control",
                "sha256": "8ded65200b617b4e3f9567bf8483ffbdc119bff9f97e837c195d663e0e4b9531"
              }
            },
            "composition_evidence": [
              {
                "path": "logs/receiver_tier2_a1.log",
                "kind": "runtime_log",
                "sha256": "79d75da6cdaf618156104d12314b498476ea4554866c21ec73d0b4026786643d"
              },
              {
                "path": "logs/receiver_tier2_a2.log",
                "kind": "runtime_log",
                "sha256": "697810e4bdeb8583b787dc3b561ca1cc2e8fa6adfb9b0bd627762ab6e1ec8a73"
              },
              {
                "path": "logs/sender_tier2_a1.log",
                "kind": "request",
                "sha256": "dceba61d1270b81b517061553d020b052df5302461056f2ff7a4c74059eb4a8e"
              },
              {
                "path": "logs/receiver_fixed_a1.log",
                "kind": "response",
                "sha256": "66e3d738ec0db19d68ebfdc63c670dcbb9a6ee30e7a538d929c4e795f81a40f3"
              }
            ]
          }
        }
      },
      "fingerprint": "37f26e63e38b2c1d93cb311d2727974d6869c7f906c6a2b66385e2dcda6dea16",
      "created_at": "2026-08-26T09:46:06.983319Z",
      "updated_at": "2026-08-26T09:46:06.983319Z"
    }
  ]
}