Log4j RCE Found

Post by wfyfgrh » Fri, Dec 10, 2021, 2:09 PM UTC

Post by nobleach » Fri, Dec 10, 2021, 2:13 PM UTC

fnord77 wrote: post #142

shepherdjerred wrote: post #101

Earlier quoted context omitted.

I disagree strongly with this. You're better off learning the de-facto libraries of your language. Your employer, or any production application you're going to work on is probably going to use one of these libraries. I learned the most common Java libraries when writing personal projects -- Lombok, log4j, Guava, Gson, Jackson, Netty, etc. I had a significantly gentler learning curve at my first job. We used these com…

avoid google libraries like the plague, there's absolutely no need for them unless you're using protobuf. I don't understand why people are using lombok after java 16. Jackson and log4j are sort of essential, unfortunately. more libraries = more attack surface.

Post by wyager » Fri, Dec 10, 2021, 2:14 PM UTC

dikei wrote: post #215

spullara wrote: post #209

Earlier quoted context omitted.

This is just stupid. Logging should not do any side effects except writing to the log.

I'm not defending Log4j, but this error can really happen to many logging libraries. All logging libraries contain some kind of template engine as a performance optimization, in order to avoid actually generating the output string (can be costly) if logging is disabled. And template engines have always been a major source of vulnerabilities.

Post by Quekid5 » Fri, Dec 10, 2021, 2:20 PM UTC

ximm wrote: post #191

hawk_ wrote: post #110

Earlier quoted context omitted.

While that's an interesting vector for attack, is it realistically an issue? Terminals are run as root all the time. I would guess any mainstream ones are well reviewed to not have such exploits work. Are you aware of any actual attacks exploiting terminal parsing in the wild?

Classic confusion: terminals typically run as users, but the shells in them often run as root. I could imagine an attack like this: printf 'rm -rf /\n\033[%iAecho "Hello World!"\n' When executed in a terminal this looks like it generates an innocent shell script. But when piped into a file and the executed it will delete all your files.

Post by FDSGSG » Fri, Dec 10, 2021, 2:26 PM UTC

hawk_ wrote: post #110

jrockway wrote: post #76

So a lot of people sound mad that the logging library is parsing the inputs, and maybe they should be, but the truly paranoid should also be aware that your terminal also parses every byte given to it (to find in-band signalling for colors, window titles, where the cursor should be, etc.). This means that if a malicious user can control log lines, they can also hide stuff if you're looking at the logs in a terminal.…

While that's an interesting vector for attack, is it realistically an issue? Terminals are run as root all the time. I would guess any mainstream ones are well reviewed to not have such exploits work. Are you aware of any actual attacks exploiting terminal parsing in the wild?