Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

techsolvency.com

Post reply on HN
Print view View original

31–40 of 209 posts

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#31

Post by tyingq »

eganist wrote: post #18
ronnier wrote: post #12

Are there any notable systems exploited by this besides minecraft?

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected. I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected. And that list in the en…

There's also a tendency for a lot of Cybersecurity type software to use java and log4j. Things like SAML, SSO, code scanning, etc. I'm fighting a bit of schadenfreude watching all of those vendors furiously trying to get their stories together.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#32

Post by isbvhodnvemrwvn »

mateuszf wrote: post #5
benburleson wrote: post #4

Earlier quoted context omitted.

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Yeah - for example to determine if log4j is used in a maven project one would have to run "mvn dependency:tree | grep log4j". Which I did today for our 60 microservices. And also for projects deployed as war files - container server libraries also have to be checked.

It's probably worth refining it to `log4j-core`. `log4j-api` or various bridges like `log4j-to-slf4j` are not affected, but will show up in nearly any spring boot app.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#33

Post by bob1029 »

ThinkBeat wrote: post #19

Ideally, log4j should not have the ability to make "outgoing calls" right? It has been years since I used it but I can't remember a valid reason why it should be allowed to do so. Since it is running inside the stack it may not be easy to enforce it. If the "client" log4j does it before even logging that is a bother. It seems like having a "central" "syslog" logging server. Traffic goes from the stack -> logging serv…

> Ideally, log4j should not have the ability to make "outgoing calls" right?

What is the intended scope of log4j? I spent some time looking over the source code and cannot fathom why something that logs information would need to become this complicated.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#34

Post by staticassertion »

ThinkBeat wrote: post #19

Ideally, log4j should not have the ability to make "outgoing calls" right? It has been years since I used it but I can't remember a valid reason why it should be allowed to do so. Since it is running inside the stack it may not be easy to enforce it. If the "client" log4j does it before even logging that is a bother. It seems like having a "central" "syslog" logging server. Traffic goes from the stack -> logging serv…

That would help but it isn't enough. You can still load classes from your class path, and then those would make the calls instead. And log4j does have valid reasons to read/write to files, naturally.

But yes, I think a major issue here is a logging library packaging its own meta language that can trigger side effects.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#35

Post by the_af »

imwillofficial wrote: post #23
benburleson wrote: post #4

Earlier quoted context omitted.

"A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)

Can you parse this quote for me? I do not understand it.

It means that even if your Java project doesn't directly use log4j as a dependency, nor mention it explicitly, it will be very likely included as a transitive dependency via other libs (and even logging frameworks!) that you use.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#36

Post by layer8 »

ThinkBeat wrote: post #19

Ideally, log4j should not have the ability to make "outgoing calls" right? It has been years since I used it but I can't remember a valid reason why it should be allowed to do so. Since it is running inside the stack it may not be easy to enforce it. If the "client" log4j does it before even logging that is a bother. It seems like having a "central" "syslog" logging server. Traffic goes from the stack -> logging serv…

The main design mistake in log4j is that it performs ${…} substitution on the complete log message by default. There’s no way for application code using the log4j front-end API to have input data containing such strings be logged verbatim, without nonstandard log4j back-end configuration (someone correct me if there’s actually a way). In principle, each application has to sanitize all strings to be logged by stripping/escaping all log4j substitution syntax from them, to prevent unexpected substitutions.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#37

Post by krzyk »

vips7L wrote: post #13
winternett wrote: post #3

Clone Git Repo... CTRL+F "log4j"... 0 results... (sigh of relief)... :|

Really should run `mvn dependency:tree | grep log4j`

Some libs might shade log4j. You need to look for JndiLookup.class in all jars.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#38

Post by staticassertion »

ronnier wrote: post #12

Are there any notable systems exploited by this besides minecraft?

It's still very early, we won't have breach notifications for a while since any attacks would have started in the last few weeks at the earliest, and most would have started last week.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#39

Post by formerly_proven »

stuff4ben wrote: post #21
lostmsu wrote: post #16

Earlier quoted context omitted.

JetBrains IDEs are probably affected.

Why would you even call that out when you don't know? Just because it uses Java does NOT mean it uses log4j. None of Jetbrains IDEs are affected btw.

They contain (among many other things) a log4j copy with the vulnerability, so saying they might be affected isn't unreasonable.

Re: Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide

#40

Post by srcreigh »

jbverschoor wrote: post #10

What about desktop application vulnerabilities? There are quite a few applications built with java, which include log4j.

They are listed.

Biggest one is probably the Minecraft client

> Minecraft users were using it to execute programs on the computers of other users by pasting a short message in a chat box.

https://www.ctvnews.ca/sci-tech/the-internet-s-on-fire-as-te...

Last night, we kept getting disconnected from HyPixel on Minecraft 18.1 client. I wonder if they check for the vulnerability and boots people? Although 18.1 should be fixed. When we added the log4j JVM flag mitigation, we stopped getting booted.

Post reply on HN