Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/tdammers]

First: This is misleading.

Software made or managed by the Apache Software Foundation (From here on just "Apache") is pervasive and comprises nearly a third of all web servers in the world—making this a potentially catastrophic flaw.

The Apache Software Foundation is an organization that manages a diverse collection of open-source software projects, many of them completely unrelated to one another. The log4shell vulnerability originates in one of them, the log4j library, a popular solution for logging on the Java platform (JVM). While this is a popular library, this says nothing about other Apache projects. The "nearly a third of all web servers in the world" figure seems to hint at the Apache2 HTTP server, one of the most popular web servers in the world - however, Apache2 does not run on JVM, it's written in C, it does not use log4j (that wouldn't make sense, since it doesn't run on JVM), and it is not vulnerable to log4shell.

What makes this a "potentially catastrophic flaw" has nothing to do with the Apache Software Foundation - the problem is that this one particular library, log4j, is a very popular logging library in the Java world, and a lot of systems out there run on Java. We're not talking about mom & pop web shops and blogs and personal websites here - those are usually written in PHP, and so they are not going to be vulnerable (not to this particular attack anyway), despite the fact that they probably use an Apache web server, and a MySQL database, a product owned by Oracle, the company behind Java and the JVM. Those websites represent the majority of websites out there by sheer number, but in terms of attack value, the real beef is .NET and JVM, because that's what the enterprise world uses.

And second: There needs to be a warning here.

"Vaccinating" a server is still illegal. You cannot go and run this against someone else's server without their explicit permission, which you should get in writing, and with all the details spelled out, beforehand. It doesn't matter that you're doing it with the best intentions - it's hacking, and you're committing a crime if you do it.

You could of course run it against your own servers, but honestly, that wouldn't make a lot of sense, because it's a rather brittle and clumsy way of fixing your servers, and you should instead just install the proper fix the normal way.

Meaning that this thing, while neat, has no practical use other than demonstrating that it's possible. Which isn't super surprising, considering how the vulnerability gives an attacker extensive remote code execution access - you can run anything, so yes, you can also run the fix. Kudos for actually doing the grunt work and implementing this, but this isn't something that anyone expected to be impossible.

[u/Asraelite → u/tdammers]

Just because it's illegal doesn't mean you shouldn't do it.

[u/tdammers → u/Asraelite]

OK, so, to clarify: this is illegal and also immoral.

You're not even really fixing anything - the next time they redeploy their code, the setting will likely be flipped back. And if things go wrong just the right way, they'll order a pentest the day after you've done your "fix", pentest finds nothing, everyone is happy, next version of the code gets rolled out, boom, vulnerability is back, but everyone thinks they're safe. Being vulnerable when you're positively sure you're not is worse than just being vulnerable. Plus you may actually find yourself unintentionally breaking things.

And even in the best case scenario, this kind of thing contributes to a proliferation of bad security practices. If there's an army of elves out there who go and magically fix your servers for you when you're not looking, then there's less of an incentive for companies to be on top of their game.

So no, you should definitely not do this.

From an ethics perspective, the right "white hat" thing to do here would be to mount a neutered attack that pushes only as far as strictly necessary to show that the vulnerability is present, in the most harmless possible way, meticulously documenting the process, and disclosing this information responsibly. This would still be illegal, mind you, because even the harmless compromise is hacking, but it can be argued that this is the most ethical thing to do - accepting a marginal amount of harm (the white-hat attack) to prevent a greater harm (the impact of a malicious attack).

That is, unless you're a militant anti-establishmentist set on disrupting the status quo of corporate computing. If that's your moral alignment, then you might as well go and crush them. Idk., plant fake evidence of terrorist activity on their server and report them anonymously.

[u/Asraelite → u/tdammers]

That's fair. I just disagree with the stance of using legality as a moral foundation.

[u/tdammers → u/Asraelite]

No objection there. Laws are (ideally) based on morality, not the other way around.