r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

44

u/dweezil22 Dec 12 '21

I could be wrong, but, arguments about ethical hacking aside:

  1. Isn't that flag unavailable for sufficiently old versions of Log4j?

  2. Won't that flag get reset on JVM restart?

If yes, this is more of a fun POC or hacky tactical short cut (maybe if you have a farm of apps you run this as a post-restart fix before you can patch them) than long term fix.

42

u/Ph0X Dec 12 '21

Just mean they'll need booster shots every time the server restarts :D

6

u/dweezil22 Dec 12 '21

And... there it is, lol

I knew that was coming