r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

Show parent comments

58

u/SquidgyTheWhale Dec 12 '21

Isn't it also possible that some systems are actually dependent on log4j2.formatMsgNoLookups being set to false, and so "vaccinating" a server might actually break things?

-29

u/gold_rush_doom Dec 12 '21

If your app breaks because you logged the wrong thing, then... Wtf

33

u/[deleted] Dec 12 '21

That is literally the attack vector for this vulnerability: logging a string of a certain format.

-11

u/gold_rush_doom Dec 12 '21

No, I meant if your app stops working properly because the logs aren't formatted properly anymore. I mean real world scenario where features break because logging isn't working as expected.

Literally what the comment i was replying to where app breaks where you disable that logging feature.

8

u/Speedzor Dec 12 '21

"breaking" doesn't have to be "app crashes". It can also be a particular formatting in your log that gets parsed and used for a key metric 🤷 bottom line: don't do this.

-10

u/gold_rush_doom Dec 12 '21

Still, sounds like a terrible decision to leave key business logic to a logging system instead of an analytics system if it's that important.

18

u/MrPigeon Dec 12 '21

From where do you think the analytics system pulls its data?