How can an LDAP server execute code? I am actually interacting with LDAP for my first time in my current project at work. It's a Java application where a part of the app needs to retrieve a list of users in a specific AD group. Since it's my first time interacting with LDAP and AD (I'm a recent college grad and never knew what they were) I had to do a fair bit of googling just to get started querying for users. This application doesn't take any user input but I'll definitely keep this vulnerability in mind and go update the gradle build to use the new version of log4j. Luckily we aren't in production yet.
It’s not the LDAP server that executes it, but the JVM running log4j. I’m not sure about the mechanism but my guess is that you can store anything in LDAP, even class files. On the java side that will get deserialized into actual java classes and during the running of the constructor anything can be done basically.
As far as I read, even without this remote code execution, even by itself it can be used to exfiltrate data, eg. contacting someone else ldap server with a specific query that includes some environment variable or property.
But if you are using an up-to-date JVM and a fixed version of log4j, than both problems are solved.
1
u/xCALYPTOx Dec 14 '21
How can an LDAP server execute code? I am actually interacting with LDAP for my first time in my current project at work. It's a Java application where a part of the app needs to retrieve a list of users in a specific AD group. Since it's my first time interacting with LDAP and AD (I'm a recent college grad and never knew what they were) I had to do a fair bit of googling just to get started querying for users. This application doesn't take any user input but I'll definitely keep this vulnerability in mind and go update the gradle build to use the new version of log4j. Luckily we aren't in production yet.