Log4j2 MarshalledObject二次反序列化

p0l1st@venomsec.org (p0l1st) — Tue, 01 Sep 2026 15:08:05 +0800

https://mp.weixin.qq.com/s/SISyQLvg17GabC0YB7Pfvw

MarshalledObject的get方法可以反序列化

public T get() throws IOException, ClassNotFoundException {
    if (objBytes == null)   // must have been a null object
        return null;

    ByteArrayInputStream bin = new ByteArrayInputStream(objBytes);
    // locBytes is null if no annotations
    ByteArrayInputStream lin =
        (locBytes == null ? null : new ByteArrayInputStream(locBytes));
    MarshalledObjectInputStream in =
        new MarshalledObjectInputStream(bin, lin);
    @SuppressWarnings("unchecked")
    T obj = (T) in.readObject();
    in.close();
    return obj;
}

objBytes可控

 private byte[] objBytes = null;

可通过构造方法赋值

Log4j2 - Category - p0l1st's blog

Log4j2 MarshalledObject二次反序列化