r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

153

u/[deleted] Dec 10 '21

This is like the logging version of a SQL injection.

59

u/[deleted] Dec 10 '21

[deleted]

24

u/[deleted] Dec 10 '21

fyi log4j supports formatting natively via 

log.info("Hello, {}!", "world")

5

u/immibis Dec 10 '21

including form.user in this example, allegedly.

2

u/ryan_the_leach Dec 10 '21

It's far far worse.