Re:Drop-In Replacement for Memcached
by ploxiln on Sunday December 12, 2021 @09:00PM
(#29535726)
Loading and running a java class is only the most absurd exploitation possibility with log4j. Without that, you can still slurp any environment variables (or other process information) and send it to any host. And you can probably do yet other stuff too, it is quite flexible ...
[ Parent
| on HN ]
Re:Drop-In Replacement for Memcached
by staticassertion on Sunday December 12, 2021 @10:15PM
(#29536191)
> Loading and running a java class is only the most absurd exploitation possibility with log4j.
Uh, yeah, the RCE was very bad. And not a thing with Rust due to not having object serialization.
> you can still slurp any environment variables (or other process information) and send it to any host
Yeah, you can write a logger in rust that does really crazy things like adding environment variables through some sort of parsing of a language construct. That would still be a problem, but a lot less serious. It would probably also be really unidiomatic, but that's a separate story.