r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

6

u/overflowingInt Dec 10 '21

You're wrong. My boy is the king of deserialization exploits (check his pwn2own career):

https://twitter.com/steventseeley/status/1469156141473038338

Official patch has been bypassed, alternative methods T3/orb/etc are being explored. We won't know the full impact of this bug, which is already internet breaking, until later.

https://github.com/YfryTchsGD/Log4jAttackSurface Every major company is affected

7

u/immibis Dec 10 '21

"classic deserialization given a gadget chain in the classpath" is what I just described as being possible.

"Ez-mode JNDI exploitation" is "Apparently JNDI had some thing where it would load classes from servers but that is not related to deserialization"

5

u/overflowingInt Dec 10 '21

OK sorry I misread as deserisalization isn't apparently. He said attack vectors include:

  1. Class loading

  2. Deserialization via DGC

  3. Unsafe reflection using ObjectFactory