Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4j RCE Found

lunasec.io

Post reply on HN
Print view View original

241–250 of 531 posts

Re: Log4j RCE Found

#241

Post by jallen_dot_dev »

shepherdjerred wrote: post #147
asddubs wrote: post #131

Earlier quoted context omitted.

Seems like you're disagreeing on the basis of personal development rather than whether it makes sense for any given project. I think at that point it depends on whether you're primarily coding to learn or to make software

By the same token why would you roll your own instead of using a tried and true library that any experienced Java developer already knows?

> why would you roll your own instead of using a tried and true library

For one, the very reason we are all in this thread right now.

Re: Log4j RCE Found

#242

Post by michaelt »

kelnos wrote: post #187

On one hand I want to be more forgiving of this, because log4j is very old, and likely this feature was introduced well before we all had a collective understanding of how fiddly and difficult security can be, and how attackers will go to extreme effort to compromise our services. But at the same time... c'mon. A logging framework's job is to ship strings to stdout or files or something. String interpolation should n…

> A logging framework's job is to ship strings to stdout or files or something.

I've seen people (including here on HN) dismiss libraries as "abandoned" when they went a year without a release.

The software industry will never get bug-free, feature-complete software so long as we're selecting for the opposite.

Re: Log4j RCE Found

#244

Post by isbvhodnvemrwvn »

fauria wrote: post #225
lewisjoe wrote: post #163

To folks wondering what the issue is about, I'll give a short summary that I myself needed. Typically a logging library has one job to do: swallow the string as if it's some black box and spit it elsewhere as per provided configurations. Log4j though, doesn't treat strings as black boxes. It inspects its contents and checks if it contains any "variables" that need to be resolved before spitting out. Now there's a bun…

> I'm still not quite sure why LDAP comes into the picture According to https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-... , SecurityManager is not enforced on remote class loading when using JNDI's LDAP server provider interface.

Let's be honest, barely anyone even uses SecurityManager in the real world.

Re: Log4j RCE Found

#245

Post by ninkendo »

dikei wrote: post #215
spullara wrote: post #209

Earlier quoted context omitted.

This is just stupid. Logging should not do any side effects except writing to the log.

I'm not defending Log4j, but this error can really happen to many logging libraries. All logging libraries contain some kind of template engine as a performance optimization, in order to avoid actually generating the output string (can be costly) if logging is disabled. And template engines have always been a major source of vulnerabilities.

Eliding the string interpolation doesn’t necessarily have to be a feature of the logging library, the language itself can have affordances for this.

For example in swift, log.debug("my name is \(expensiveCalculate(name))") doesn’t have to evaluate “expensiveCalculate(name)” unless the logger actually opts to instantiate the string (which it can skip if say, debug logging is disabled.) This is because Swift’s string interpolation is implemented as lazily-evaluated closures, and all the “debug” method has to do is tag the input as an @autoclosure and it can avoid evaluation until it actually calls the closure. No templating is needed, just native string interpolation provided by the language.

Re: Log4j RCE Found

#246

Post by jsiepkes »

isbvhodnvemrwvn wrote: post #244
fauria wrote: post #225

Earlier quoted context omitted.

> I'm still not quite sure why LDAP comes into the picture According to https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-... , SecurityManager is not enforced on remote class loading when using JNDI's LDAP server provider interface.

Let's be honest, barely anyone even uses SecurityManager in the real world.

There is even a JEP to remove the SecurityManager all together: https://openjdk.java.net/jeps/411

Re: Log4j RCE Found

#247

Post by [deleted] »

fnord77 wrote: post #142
shepherdjerred wrote: post #101

Earlier quoted context omitted.

I disagree strongly with this. You're better off learning the de-facto libraries of your language. Your employer, or any production application you're going to work on is probably going to use one of these libraries. I learned the most common Java libraries when writing personal projects -- Lombok, log4j, Guava, Gson, Jackson, Netty, etc. I had a significantly gentler learning curve at my first job. We used these com…

avoid google libraries like the plague, there's absolutely no need for them unless you're using protobuf. I don't understand why people are using lombok after java 16. Jackson and log4j are sort of essential, unfortunately. more libraries = more attack surface.

[deleted]

Re: Log4j RCE Found

#248

Post by wbl »

kelnos wrote: post #187

On one hand I want to be more forgiving of this, because log4j is very old, and likely this feature was introduced well before we all had a collective understanding of how fiddly and difficult security can be, and how attackers will go to extreme effort to compromise our services. But at the same time... c'mon. A logging framework's job is to ship strings to stdout or files or something. String interpolation should n…

The Ware report is 60 years old. String formatting bugs are about 20 or 30.

Re: Log4j RCE Found

#249

Post by mkleczek »

immibis wrote: post #236
mkleczek wrote: post #214

This is actually worse than log4j. Any code accessing JNDI using URIs from external data is vulnerable. Script injection (aka XSS) at its finest. Looks like a good use case for running under SecurityManager with a restrictive policy. Maybe it is time to reconsider JEP 411?

How many code accesses JNDI using URIs for external data? Debug tools, presumably. Monitoring tools.

Any JEE code that uses container provided resources. So a lot...

Re: Log4j RCE Found

#250

Post by dikei »

ninkendo wrote: post #245
dikei wrote: post #215

Earlier quoted context omitted.

I'm not defending Log4j, but this error can really happen to many logging libraries. All logging libraries contain some kind of template engine as a performance optimization, in order to avoid actually generating the output string (can be costly) if logging is disabled. And template engines have always been a major source of vulnerabilities.

Eliding the string interpolation doesn’t necessarily have to be a feature of the logging library, the language itself can have affordances for this. For example in swift, log.debug("my name is \(expensiveCalculate(name))") doesn’t have to evaluate “expensiveCalculate(name)” unless the logger actually opts to instantiate the string (which it can skip if say, debug logging is disabled.) This is because Swift’s string i…

I would consider a programming language's native string interpolation as a form of templating, but to each his own.
Post reply on HN