News for hackers. Stuff that matters.

A comment on Widespread exploitation of critical remote code execution in Apache Log4j. Parent comment

Re:Widespread exploitation of critical remote code execution... by jbourne on Saturday December 11, 2021 @10:36AM (#29521567)
Yes this is still possible if you log any user-modifiable value. One example would be logging out a user agent header - if an attacker spoofs this to include a JDNI URI then the vulnerability can be exploited.

This is why this CVE is so scary - I would imagine the majority of applications using log4j will log out a user-supplied value at some point.

[ Parent | on HN ]
Re:Widespread exploitation of critical remote code execution... by bostik on Saturday December 11, 2021 @01:20PM (#29522994)
How about feeding the magic string via Host header in your requests and then cutting off? You wouldn't even need to establish the full TLS handshake, SNI is sent in the clear, and you would get to hit every single load-balancer and middle box - and everything they send their logs to.

Oh, and WAF rules won't protect you either: https://twitter.com/Rezn0k/status/1469523006015750146

[ Parent | on HN ]