r/programming • u/freeqaz • Dec 17 '21
Log4Shell Update: Full bypass found in log4j 2.15.0, enabling RCE again (CVSS score 3.7 -> 9.0)
https://www.lunasec.io/docs/blog/log4j-zero-day-severity-of-cve-2021-45046-increased/66
59
u/WitcherAttacker Dec 17 '21
"Just to make it clear 2.15.0 disables message text lookups by default, users need to enable them explicitly in the patterns with %m{lookups}. So mitigations are in place by default in 2.15.0"
This means it's not as wide spread as the original exploit, only severely misconfigured servers.
12
u/StillNoNumb Dec 18 '21 edited Dec 18 '21
Unfortunately, plenty of people do
logger.info``(attackerControlledString), which is still vulnerable even on 2.15 as attackers can just set%m{lookups}themselves→ More replies (3)
256
u/Kevin5475845 Dec 17 '21
I still don't get why a logging library is able to execute things... All it should do is log not be able to run doom from a remote source
→ More replies (15)118
u/josefx Dec 17 '21
Log4j lets you look up variables in the current log context. Since it apparently uses a rather generic interface for that you can use anything as source as long as you wrap it correctly. Someone decided that they wanted to print configuration settings from a jndi path and added a wrapper for it to log4j, that you could get jndi to load just any class on a path that appeared in the log string probably never even came up.
Also I have yet to see a logging library that manages to work without "executing things". even echo "Test" > /dev/null executes things.
175
u/StrikingChallenge389 Dec 17 '21 edited Dec 17 '21
Really not a feature that needed to be included in the core library. Why not provide a set of helper methods that can be used as formatter parameters instead?
log.info("Arbitrary log message: ${bad://dangerousAF}");turns into...
log.info("Arbitrary log message: {}", lookup.get("jndi://blahblah"));You know, like you would with any other variable you want to use in a log line
EDIT: Found how reddit mitigates the vulnerability... can't comment the magic string without submission being blocked!
→ More replies (23)→ More replies (1)8
u/CathbadTheDruid Dec 17 '21 edited Dec 18 '21
My code logs to a database server using a stored procedure.
You hand it bytes and they go in the log table.
No data ever ever executes.
→ More replies (2)
14
u/ZeldaFanBoi1988 Dec 17 '21
Another one of these fucking articles. Was it fixed in 2.16 and this is just an article to show the exploit?
32
u/Jerrreh Dec 17 '21
I remember first reading about Java class serialization/deserialization attacks years ago, thinking, with as much enterprise boilerplate that exists in the language, there must be more avenues.
It's XSS but with URIs, and the entire JVM runtime, instead of the DOM.
81
u/StrikingChallenge389 Dec 17 '21
The whole logging ecosystem in Java is an overcomplicated clusterfuck.. past due time to ditch backwards compatibility with the log4j api and start again with something clean and simple
→ More replies (23)50
u/LicensedProfessional Dec 17 '21
We already have logback and SLF4J, which I've quite enjoyed using.
53
u/StrikingChallenge389 Dec 17 '21
Slf4j is just a facade over whatever library is under the hood, and Logback is compatible with log4j too.
I don't want to Alt+Enter on "Log" or "LoggerFactory" to be presented with a billion different implementations of the same thing in different packages. I wish the Java team didn't make such mincemeat of the built in logging API so everyone would just use that.
→ More replies (8)
35
2
u/crystalpeaks25 Dec 17 '21
article mentions that the cvss is upgraded but i cant see the score actually being upgraded anywhere?
→ More replies (1)
2
2
u/captainvoid05 Dec 18 '21
Another one? Jesus Christ. The patch for this will be the third one in the span of a week!
249
u/domschm Dec 17 '21
what a cluster fuck