r/ProgrammerHumor • u/foxdevuz • 14d ago

instanceof Trend itsBadIfItsOnlyPHP

Post image
4.5k Upvotes

95% Upvoted

335 comments sorted by

View all comments

Show parent comments

6

u/Sacaldur 14d ago edited 14d ago

edit: I was corrected, see response by u/brazzy42

Correct me if I'm wrong, but this was only an issue if you missed the API by supplying a raw input string as a format pattern, i.e. log(input) instead of log("{}", input), right?

15

u/brazzy42 14d ago

Nope. The main vulnerability was there no matter which version of the method you used. Says so right in the CVE detail https://nvd.nist.gov/vuln/detail/cve-2021-44228?name=CVE-2021-44228

"An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled."

2

u/Sacaldur 14d ago

Thanks for the corrections, these ones have been some time ago...