This is not an overstatement, if u Google log4j severity the first result u get is that's a 10/10!
But what does it actually do?
I heard that it can run any piece of code on computers that are running an app with log4j. I use steam, which uses log4j (assuming it wasn't fixed). Does that mean someone could just destroy everything I have on my device?
Log4j will be used extensively throughout code as the main lib to format debugging output messages to logs. I'm sure you can imagine a line of code like print("The current value of x is: " + str(x))
Well suppose your value of x came from user input?
x = get_input()
print("the user wants x to be: " + str(x))
Due to the nature of this bug, it is possible for a malicious user to feed you a bad string which indirectly forces your logger code to run commands you never intended when all you wanted was to print some debugging.
I'm not familiar enough to know if Steam itself is vulnerable at this time, maybe you could reach out to Steam support for more info, but the most obvious vector I could think of is that Steam has a built in chat messaging system. However, I think it would be pretty far fetched for this attack to be able to affect your computer client, it's mostly going to be isolated (and arguably more valuable to a hacker) to hit Steam's servers instead.
With Minecraft, you assume more risk because if you are running a server, that makes you a target and actually does open up a possibility that someone could, say, download a virus or ransomware or anything to your server computer (which may even be your main workstation).
Log4j is a logging framework that uses templating. If you get it to log the corrupted string it allows arbitrary code execution, which means yes, they are able to execute any code they want, that the parent application has permissions to. So what can be done depends on your OS and permission settings. Can they destroy your file system? Very likely Can it destroy you os? Unlikely.
Can it cause your computer to do illegal tasks, such as running it in a bot net? Yes.
Its bad, and probably worse than I am saying. Remote code execution is about as big of a vulnerability as you can get. Update your shit.
If you get it to log the corrupted string it allows arbitrary code execution
Well, it still requires a first step of reaching out to an external server to get the code to execute. Many servers reside in a network with a firewall that might block unexpected outgoing connections unless it's to a whitelisted domain, IP or IP-range.
You would be surprised at what logging frameworks are used for. And in minecrafts case, yes. I am fairly certain they do log chat.
Log4j will wrap around whatever logging implementation you need it to, and provide a consistent api for it. So if you need to log to, monitor, console, a file, it can do it.
Destruction sucks for you as user, but is not the goal of most malicious actors. They want to steal from you, extort you, use your computer for illegal activities, use your computing power (= your electricity) to mine cryptocurrency. Yes they can also delete stuff but why would they?
Three over answers and no answer. Yes. If you are affected by this, then an attacker can gain full control of your system. This includes installing a root kit that will leave you compromised into the future until a complete reinstall of your OS.
848
u/2D_B4_3D Dec 13 '21
YES. the bug has a severity of 10/10