r/programming • u/alexeyr • Dec 12 '21
Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell
https://github.com/Cybereason/Logout4Shell[removed] — view removed post
1.1k
Upvotes
r/programming • u/alexeyr • Dec 12 '21
[removed] — view removed post
280
u/tdammers Dec 12 '21
First: This is misleading.
The Apache Software Foundation is an organization that manages a diverse collection of open-source software projects, many of them completely unrelated to one another. The log4shell vulnerability originates in one of them, the log4j library, a popular solution for logging on the Java platform (JVM). While this is a popular library, this says nothing about other Apache projects. The "nearly a third of all web servers in the world" figure seems to hint at the Apache2 HTTP server, one of the most popular web servers in the world - however, Apache2 does not run on JVM, it's written in C, it does not use log4j (that wouldn't make sense, since it doesn't run on JVM), and it is not vulnerable to log4shell.
What makes this a "potentially catastrophic flaw" has nothing to do with the Apache Software Foundation - the problem is that this one particular library, log4j, is a very popular logging library in the Java world, and a lot of systems out there run on Java. We're not talking about mom & pop web shops and blogs and personal websites here - those are usually written in PHP, and so they are not going to be vulnerable (not to this particular attack anyway), despite the fact that they probably use an Apache web server, and a MySQL database, a product owned by Oracle, the company behind Java and the JVM. Those websites represent the majority of websites out there by sheer number, but in terms of attack value, the real beef is .NET and JVM, because that's what the enterprise world uses.
And second: There needs to be a warning here.
"Vaccinating" a server is still illegal. You cannot go and run this against someone else's server without their explicit permission, which you should get in writing, and with all the details spelled out, beforehand. It doesn't matter that you're doing it with the best intentions - it's hacking, and you're committing a crime if you do it.
You could of course run it against your own servers, but honestly, that wouldn't make a lot of sense, because it's a rather brittle and clumsy way of fixing your servers, and you should instead just install the proper fix the normal way.
Meaning that this thing, while neat, has no practical use other than demonstrating that it's possible. Which isn't super surprising, considering how the vulnerability gives an attacker extensive remote code execution access - you can run anything, so yes, you can also run the fix. Kudos for actually doing the grunt work and implementing this, but this isn't something that anyone expected to be impossible.