News for hackers. Stuff that matters.
Re:Log4j RCE Found by tmd83 on Friday December 10, 2021 @01:22AM (#29506975)
Exactly and this being enabled by default seems specially more unusual. I can understand config being parseable even though log configurer directly pulling a remote config is a stretch specially by default. But I don't think it's unlikely that people would by default assume that their log message would be parsed that way and as someone said it even works if that's used as a user input using {} instead of +.

There are no comments on this comment yet.