Apache MINA AbstractIoBuffer.resolveClass Allowlist Bypass RCE

Repository is a self-contained Java PoC suite for CVE-2026-42779, a deserialization filter bypass in Apache MINA's AbstractIoBuffer.resolveClass() affecting MINA 2.1.0-2.1.11 and 2.2.0-2.2.6. The exploit is not tied to a public exploit framework; it consists of three standalone Java programs, a Dockerfile, a Makefile, and a Bash entrypoint wrapper. Structure and purpose: - FilterBypassPoC.java: demonstrates the core logic flaw by showing that MINA acceptMatchers can be bypassed for type-0 descriptors such as primitives, non-Serializable classes, and arrays. It uses IoBuffer.putObject()/getObject() locally to prove that disallowed classes still deserialize. - CraftedBypassPoC.java: shows the more realistic attacker technique. It manually crafts a MINA-compatible serialized stream by overriding ObjectOutputStream.writeClassDescriptor() to emit type-0 descriptors for all classes, then wraps the stream in MINA's 4-byte length-prefixed format. This bypasses the allowlist for arbitrary Serializable classes and nested object graphs. - RcePoC.java: escalates the bypass to code execution using a Commons Collections 3.2.2 gadget chain (ConstantTransformer -> InvokerTransformer -> Runtime.getRuntime().exec()). It crafts the same type-0 MINA payload and proves execution by creating /tmp/CVE-2026-42779-RCE-PROOF. - Dockerfile, Makefile, and entrypoint.sh: provide reproducible build/run paths for all three PoCs. - README.md: documents affected versions, root cause, exploitation flow, prerequisites, and remediation. Main exploit capability: remote exploitation of vulnerable MINA services that deserialize attacker-controlled objects over the network using ObjectSerializationCodecFactory or IoBuffer.getObject(). The exploit bypasses the intended class allowlist and can load arbitrary gadget-chain classes if present on the target classpath. In the included RCE demonstration, this results in arbitrary OS command execution. Network/targeting details: the code does not hardcode a remote IP, hostname, or HTTP endpoint. Instead, it targets any network-reachable Apache MINA endpoint using the vulnerable object deserialization path. The crafted payload format is MINA-specific: a 4-byte length prefix followed by a Java serialized object stream with attacker-forced type-0 class descriptors. Overall assessment: this is a real exploit repository, not just a detector. It contains working local PoCs for filter bypass and a practical RCE demonstration, but the payload is basic and hardcoded rather than operator-customizable, so maturity is best classified as OPERATIONAL.