3 ms·
If you look at the CVE, it's literally plain shell commands as strings in the Content-* headers. These commands would appear to be local with whatever user the
by rmrfrmrf 9y ago
If you look at the CVE, it's literally plain shell commands as strings in the Content-* headers. These commands would appear to be local with whatever user the app is running as.
- kelnos 9y agoAnd that's the ridiculous thing: this is actually a fairly easy thing to protect against. Why the hell did the webapp servers have direct access to the database? If there was a service in the middle mediating requests, that would have been another line of defense. Sure, maybe _that_ service might have holes, but it'd be another hurdle the attacker would have to clear.
- rmrfrmrf 9y agoAs long as JNDI is a best practice in Java land, I'd say that the majority of Java app servers are directly connected to databases.
- kelnos 9y agoIs it? I've been doing Java on and off for nearly a decade (with a brief foray into it in the early 2000s) and I had to look up what JNDI is.