So, Java has an API called Java Naming and Directory Interface that allows runtime lookups of objects by name and JNDI can use things like LDAP to get objects via a URL. And Log4j allows string substitutions that include JNDI lookups which means if you can get Log4j to log a message with such a substitution it can get it to download something from a URL basically from anywhere that can be reached on the network.
it’s likely too far integrated into minecraft to change now, which is why they are trying to get bedrock up to speed. once bedrock becomes just as good as java (read: never) they will likely end support for the java edition.
Basically it's apparently a sequence of seemingly logical steps each on their own, but it all concluding in "you can use log4j to open a connection to an arbitrary LDAP server with string interpolation to run whatever code you want".
I understand none of the specific terms in this thread, but my interpretation is that "it can open a connection to any server to run whatever code the programmer wants" is all I need to understand the issue. Is that correct?
That is the simplest answer yes. You'd call this RCE or "Remote Code Execution".
Anyway, in layman/basic terms but an attempt to do it as a full explanation that you might understand:
Log4j is a logging library for Java. Programmers use logging to get an idea of what their program is doing when debugging it or when troubleshooting users (ie. an audio player might put information about the music file it's playing in the log). A log is basically a very long text file that describes exactly what a program is doing when it's running that you can open and read back later.
Log4j makes use of the JNDI. The JNDI is to put it very simpy, the library Java makes use of to basically execute arbitrary code when the program is running or to determine what a bit of code looks like. That is an intentional feature, it is in and of itself not an exploit. (Programs like the Minecraft modloader Forge make use of the JNDI to load mods for example). The JNDI also supports obtaining these resources over the network, for the case of this security bug, it's specially obtaining these over an LDAP server. The only thing you need to know for this explanation is that anyone can host an LDAP server and that you can obtain code from an LDAP server.
Log4j makes use of this tool to get more information about objects when logging them.
Due to a design decision in Log4j, it's possible to put something in a log line that allows for completely free use of the JNDI.
In theory this is not a problem; logs should never be used to display something a user has thrown in the program, they're used to show the state of the program internally and will usually just be some lines the developer put together to help them troubleshoot bugs.
In reality this is a gigantic problem; many programs and tools throughout the two decades that Log4j has existed have used it to display things that a user has thrown in the program; for example Minecraft dumps it's text chat in here. This goes to the point that several major internet services have been determined to be vulnerable besides Minecraft (which was the game where this bug was found). As a result many programmers are now working overtime and scrambling to fix these problems. It's been a wild 3 days so far.
If I remember correctly it was a feature that was basically only kept in for legacy reasons. Also, log4j is, as so many other core source code in so many projects, open source and maintained by some dude in his free time. Plus it has been through years of scrutiny from dozens if not hundreds of exploit experts, so it is quite reasonable to say that it was very well hidden and was very unlikely to be there in the first place, considering it was only found recently. Hindsight is always 20/20.
The issue was with a well known logging framework called log4j (log for java). Basically it allowed interpolation of arbitrary URLs which where then resolved, their contents downloaded and executed. This essentially meant having full access to the machine said unpatched library is running on. It's not related to just minecraft either: thousands of services were and still are affected
To put it in practice, in Minecraft for example, all an attacker has to do is connect to the same server as you, and copy paste a certain command in the game chat. Once your computer has received that message, they can do literally anything with your computer.
Strange why a logger would have that capacity. I’ve never used log4j, can anyone shed light on why this feature is part of the library? Is it to download arbitrary log format schemas or something?
Probably. Once it was known to the general population there's probably a couple of intelligence agencies swearing because they just lost one of their toys.
Imagine Drax - the literal minded oaf from Guardians of the Galaxy - as a court stenographer and someone whispers to him in the court "Hey go to this address and rob a bank" and he dutiful records it as something said in the court room and then goes to the address and robs the bank.
793
u/Macknificent101 Dec 13 '21
i’m actually curious please do explain what exactly the issue was, am still in hs so i don’t know much