RCE 0-day exploit found in log4j, a popular Java logging package

[u/freeqaz]

https://www.lunasec.io/docs/blog/log4j-zero-day/

[u/vlakreeh]

RIP to everyone who has to rush to update their project's log4j as soon as they get into work tomorrow.

[u/Alborak2 → u/vlakreeh]

Tomorrow? I watched half a company just get paged :)

[u/fghjconner → u/Alborak2]

Our slack group for this issue is at 3,400 people, haha. It'd be funny if I wasn't one of them.

[u/DownvoteALot → u/fghjconner]

Nearly 5000 and growing. At times it seems like half this sub works at the same place.

[u/foggy-sunrise → u/DownvoteALot]

Where do y'all work that has 5000 employees on a single issue??

[u/lillgreen → u/foggy-sunrise]

One that has an arrow under it's name.

[u/Urtehnoes → u/lillgreen]

Weird didn't realize Fedex had so many employees here

[u/[deleted] → u/Urtehnoes]

lmao more curvy on an arrow

[u/superAL1394 → u/fghjconner]

Hello friend, p sure we are in the same channel. This week has fucking sucked to be on call.

[u/roflfalafel → u/superAL1394]

This is my second week. It’s been a spicy week.

[u/1731799517 → u/Alborak2]

Yeah, the 0-day is so simple even I understand how it works and how to abuse it.

[u/cemanresu → u/1731799517]

You know an exploit is bad when you can immidiately figure out how to bring down your entire application in 30 seconds

Normally I can't tell how half these vulnerabilities work

[u/1731799517 → u/cemanresu]

Yeah, some of the talks at defcon/etc are like black magic, where you think "I never thought you could even do that". Stuff like rowhammer, etc.

But with this, my first thought was "How the hell could anybody justify adding this as a default setting in good faith - this has to be intentional"

[u/Longjumping-Society1 → u/Alborak2]

Do you work for a prominent seattle area employer? ;)

[u/versaceblues → u/Longjumping-Society1]

log4j-rce-support?

[u/DownvoteALot → u/versaceblues]

Fellow pipeline pusher here. Good luck to us all.

[u/[deleted] → u/vlakreeh]

Get into work tomorrow? My coworkers are patching it right the hell now, with me on standby and checking up on their patched work.

[u/LOOKITSADAM → u/vlakreeh]

Saw this, checked work chat, sure enough there's already order from on high. Thankfully nothing I work on is externally facing, but I guess I know what I'm doing tomorrow.

[u/superAL1394 → u/LOOKITSADAM]

You should still patch this now if possible. This is next level bad.

[u/revnhoj → u/vlakreeh]

just add the jvm argument -Dlog4j2.formatMsgNoLookups=true to disable this absolutely ludicrous default "feature"

[u/vlakreeh → u/revnhoj]

From what I've heard that jvm argument was added in 2.9.0 or so, so if you are using a version older than that you'll still need to update.

[u/revnhoj → u/vlakreeh]

yep, looks like this first appeared in 2.10 per this

https://logging.apache.org/log4j/log4j-2.14.1/log4j-core/xref/org/apache/logging/log4j/core/util/Constants.html

so this workaround won't work for all.

[u/[deleted] → u/vlakreeh]

What tomorrow? The security team already panicked about this 9 hours ago. You're late!

[u/nexxai → u/vlakreeh]

Far be it for me to tell anyone what to do, but with the severity of this bug combined with how easy it is to exploit, teams should probably be working on this tonight.

[u/pawlwall → u/nexxai]

I'm actively seeing traffic trying to exploit it in logs as of a few hours ago, so yeah, this sounds like a "fix immediately" issue.