Log4j RCE Found • Hacker News Board

Re: Log4j RCE Found

#51

Post by QuercusMax » Fri, Dec 10, 2021, 2:57 AM UTC

BeefWellington wrote: post #38

spuz wrote: post #36

Earlier quoted context omitted.

What benign purpose does this feature serve and why does it have to be implemented by parsing the input string? Does the input string get modified before being written into the log? I'll ask again because the information presented so far both in this thread on GitHub and on Twitter has been very lacking: is it necessary to return the input string back to the attacker in the response to their request in order for them…

Best guess: Resolving some kind of entity name to a username for some weird auditing requirement few people have ever heard of. It's the kind of feature I've seen in some software in the past. That's just a guess though.

That sounds like exactly the kind of ridiculous feature that would lead to a Java RCE

Re: Log4j RCE Found

#52

Post by [deleted] » Fri, Dec 10, 2021, 2:57 AM UTC

freeqaz wrote: post #26

Here's a write up on the exploit and how to patch it. We just wrote this up and posted it a few minutes ago (before this was even on HN, lol). https://www.lunasec.io/docs/blog/log4j-zero-day/

[deleted]

Re: Log4j RCE Found

#53

Post by Pxtl » Fri, Dec 10, 2021, 2:59 AM UTC

I give up.

It's got as many eyeballs in it as you could ever hope, and it's as mature as any piece of software ever could be.

And its job is to write text to files. It's basically a wrapper around printf.

How did this get screwed up?

Security is impossible.

Re: Log4j RCE Found

#54

Post by dylan604 » Fri, Dec 10, 2021, 3:03 AM UTC

a-dub wrote: post #50

so the question is, is it safe to log unsanitized inputs? i've argued no given the complexity of today's logging pipelines and caught a lot of flak for it in the past... now i feel vindicated.

Why would you ever trust user provided input? Like seriously, ever?

I don't trust my own input. I tend to copy&paste, and I've messed up from pasting something that was previously in the clipboard because I didn't actually hit the right keyboard shortcut when I was copying the data I thought I was. I wasn't even attempting to be malicious, but I accidentally tried a SQL Inject attack on myself because of it.

DON'T EVER TRUST USER PROVIDED INPUT!!! AHHHHH!

Re: Log4j RCE Found

#55

Post by anonymousiam » Fri, Dec 10, 2021, 3:03 AM UTC

testplzignore wrote: post #20

I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?

NSA TIA

Re: Log4j RCE Found

#56

Post by suraci » Fri, Dec 10, 2021, 3:04 AM UTC

est wrote: post #44

testplzignore wrote: post #20

I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?

> What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged I encountered a similar problem recently, my own logger can get the current container/pod IP address, it's painful to tell which host from the IPs in logs, so I had to do a manual DNS lookup to include a hostname instead. I was hoping the logger could automatically do a lookup and cache it for me…

Why didn't write logs to stdout and scrape container log files by fluentbit/promtail/etc? I'm working on logging infrastructure now and really want to know the reason behind this(before I built it...)

Re: Log4j RCE Found

#57

Post by morpheuskafka » Fri, Dec 10, 2021, 3:18 AM UTC

Anyone know of a quick way to test this just to see if it will hit the URL without setting up any exploit server to actually send any code? I guess you'd need something that reports when the DNS name gets hit (like how a DNS leak test works) but I can't find any services to do that.

Re: Log4j RCE Found

#58

Post by yc12340 » Fri, Dec 10, 2021, 3:19 AM UTC

Quiark wrote: post #32

stefan_ wrote: post #11

The best part is surely the diffstat of the "fix": +465 −9 This is insanity.

Did you look at it? Half of it is test and license headers plus the fix involves adding a whitelisting and filtering code.

"Filtering code"? This sounds like trying to plug hole in dam with one's finger. And the the hole is several meters wide.

Re: Log4j RCE Found

#59

Post by kosma » Fri, Dec 10, 2021, 3:20 AM UTC

brasetvik wrote: post #5

Are there any mitigations in recent JVMs? I tried reproducing this, and got the POC to hit the LDAP server, but it wouldn't load the test payload. See also: - https://github.com/tangxiaofeng7/apache-log4j-poc - https://github.com/mbechler/marshalsec - https://github.com/veracode-research/rogue-jndi Minecraft servers were being actively exploited according to various tweets.

I find it the most bizarre that I had my Minecraft server patched before the news even hit HN.

Re: Log4j RCE Found

#60

Post by [deleted] » Fri, Dec 10, 2021, 3:24 AM UTC

morpheuskafka wrote: post #57

Anyone know of a quick way to test this just to see if it will hit the URL without setting up any exploit server to actually send any code? I guess you'd need something that reports when the DNS name gets hit (like how a DNS leak test works) but I can't find any services to do that.

[deleted]