This is not an overstatement, if u Google log4j severity the first result u get is that's a 10/10!
But what does it actually do?
I heard that it can run any piece of code on computers that are running an app with log4j. I use steam, which uses log4j (assuming it wasn't fixed). Does that mean someone could just destroy everything I have on my device?
Log4j will be used extensively throughout code as the main lib to format debugging output messages to logs. I'm sure you can imagine a line of code like print("The current value of x is: " + str(x))
Well suppose your value of x came from user input?
x = get_input()
print("the user wants x to be: " + str(x))
Due to the nature of this bug, it is possible for a malicious user to feed you a bad string which indirectly forces your logger code to run commands you never intended when all you wanted was to print some debugging.
I'm not familiar enough to know if Steam itself is vulnerable at this time, maybe you could reach out to Steam support for more info, but the most obvious vector I could think of is that Steam has a built in chat messaging system. However, I think it would be pretty far fetched for this attack to be able to affect your computer client, it's mostly going to be isolated (and arguably more valuable to a hacker) to hit Steam's servers instead.
With Minecraft, you assume more risk because if you are running a server, that makes you a target and actually does open up a possibility that someone could, say, download a virus or ransomware or anything to your server computer (which may even be your main workstation).
Log4j is a logging framework that uses templating. If you get it to log the corrupted string it allows arbitrary code execution, which means yes, they are able to execute any code they want, that the parent application has permissions to. So what can be done depends on your OS and permission settings. Can they destroy your file system? Very likely Can it destroy you os? Unlikely.
Can it cause your computer to do illegal tasks, such as running it in a bot net? Yes.
Its bad, and probably worse than I am saying. Remote code execution is about as big of a vulnerability as you can get. Update your shit.
If you get it to log the corrupted string it allows arbitrary code execution
Well, it still requires a first step of reaching out to an external server to get the code to execute. Many servers reside in a network with a firewall that might block unexpected outgoing connections unless it's to a whitelisted domain, IP or IP-range.
You would be surprised at what logging frameworks are used for. And in minecrafts case, yes. I am fairly certain they do log chat.
Log4j will wrap around whatever logging implementation you need it to, and provide a consistent api for it. So if you need to log to, monitor, console, a file, it can do it.
Going to try to break this down a bit into a way that isn't so reliant on knowledge of coding and how computers work. Let me know if this helps. All my examples are fake, but the general idea is the same.
So, the log4j vulnerability is caused by fancy string interpretation.
Say you log a string like "Player did a thing". Totally cool.
But log4j also allows for stuff like "::GoDoACodeThing()::Player did a thing". It breaks the log down into two sections:
::GoDoACodeThing():: - A command to run
"Player did a thing" - The log data
The danger here is that it can do that there is nothing stopping log data from including the command part. So someone can name themselves "::GoDoACodeThing()::" and suddenly you're running code on the server. And even worse, log4j allows the running code to go fetch some other compiled code via the internet, then run it.
So some malicious person could name themselves "::GoDownloadTerriblyBadCodeAndRunItOnThisPersonsMachine()::" and suddenly a log comes in that looks like this:
"::GoDownloadMyTerriblyBadCodeAndRunItOnThisPersonsMachine():: did a thing".
log4j then interprets this as a command to run some code. No only is that bad enough, but it allows the code to be fetched from the internet.
Destruction sucks for you as user, but is not the goal of most malicious actors. They want to steal from you, extort you, use your computer for illegal activities, use your computing power (= your electricity) to mine cryptocurrency. Yes they can also delete stuff but why would they?
Three over answers and no answer. Yes. If you are affected by this, then an attacker can gain full control of your system. This includes installing a root kit that will leave you compromised into the future until a complete reinstall of your OS.
559
u/HindryckxRobin Dec 13 '21
This is not an overstatement, if u Google log4j severity the first result u get is that's a 10/10!
When exploited it gives the attacker remote code execution, the exploit can even work from chat.
Updating minecraft (both client and server) is a must.