News for hackers. Stuff that matters.

A comment on Widespread exploitation of critical remote code execution in Apache Log4j. Parent comment

Re:Widespread exploitation of critical remote code execution... by mumblemumble on Saturday December 11, 2021 @11:22AM (#29521996)
If you log any sort of input from outside, then attackers get to supply their own URLs.

This will trigger even if you're doing it yourself because log4j also keeps recursively expanding macros in the log string until no more are found. So parameterizing your log statements isn't a defense against this the way parameterizing your SQL statements would be for SQL injection.

[ Parent | on HN ]
Re:Widespread exploitation of critical remote code execution... by IiydAbITMvJkqKf on Saturday December 11, 2021 @02:32PM (#29523532)
>log4j also keeps recursively expanding macros in the log string until no more are found

this is insane behaviour

[ Parent | on HN ]