Log4j RCE Found

Re:Log4j RCE Found by nijave on Thursday December 09, 2021 @08:36PM (#29505459)

I'm guessing some sort of auditing or routing functionality. For instance, you have debug logs going to some development server and login events going to so audit server.

I don't have experience with this feature but there's similar use cases in log shipping utilities like fluentd

Edit: I read the other link and it looks like some sort of poorly designed RPC functionality or something shrug

Edit 2: Reading https://docs.oracle.com/javase/7/docs/technotes/guides/jndi/..., it sounds like it's a form of service discover of sorts. You talk to a registry server and it provides some object pointing to the real destination

[ Parent | on HN ]

Re:Log4j RCE Found by shp0ngle on Friday December 10, 2021 @09:14AM (#29510059)

Reading about this got me to the words “servlet” and “BeanFactory”, which I don’t really want to uncover right now, as it might open some pandora’s box

[ Parent | on HN ]

Re:Log4j RCE Found by toyg on Saturday December 11, 2021 @03:54AM (#29519527)

Those are very famous '90s Java concepts (J2EE), and I feel old for talking to somebody who doesn't know what they are.

[ Parent | on HN ]

Re:Log4j RCE Found by shp0ngle on Saturday December 11, 2021 @10:51PM (#29526961)

I remember reading about them when I learned programming in 2000s, but never used them in reality. Luckily.

[ Parent | on HN ]