7 ms·
I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is
by testplzignore 5y ago
I don't get what the point of this feature even is. What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged? And is this enabled out-of-the-box with log4j2?
- numpad0 5y agoI think this hilarious surprise from "network is the computer" principle and "it just so happens to go through xyz" transparency is just awesome.
- nijave 5y agoI'm guessing some sort of auditing or routing functionality. For instance, you have debug logs going to some development server and login events going to so audit server. I don't have experience with this feature but there's similar use cases in log shipping utilities like fluentd Edit: I read the other link and it looks like some sort of poorly designed RPC functionality or something shrug Edit 2: Reading https://docs.oracle.com/javase/7/docs/technotes/guides/jndi/jndi-rmi.html https://docs.oracle.com/javase/7/docs/technotes/guides/jndi/..., it sounds like it's a form of service discover of sorts. You talk to a registry server and it provides some object pointing to the real destination
- shp0ngle 5y agoReading about this got me to the words “servlet” and “BeanFactory”, which I don’t really want to uncover right now, as it might open some pandora’s box
- BeefWellington 5y ago> I don't get what the point of this feature even is. This is basically the response to every type of vulnerability that is based on some spec nobody's read. Same deal with XML entity parsing. Why should it make web requests, FTP requests, etc.? At some point someone had it as a requirement and everyone else gets to live with it.
- throw_nbvc1234 5y agoWhich is why they removed the functionality in the latest version (per comments below) right?
- tmm1 5y agoNot removed: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9c15fcb183170394d5f1a01ac02d3 https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...
- Quekid5 5y agoHoly moley, that's a lot of extra code... any bets on if it might contain new vulnerabilities? :)
- justinpombrio 5y agoHahaha, giving you an upvote because new vulnerabilities have, in fact, been found. (And I think one of them relates to this new code not being sufficient? Though I'm not following much anymore.)
- scottlamb 5y agoThere are two bizarre design decisions that combined into this stunning security vulnerability: the automatic trust-the-world code execution (on by default) and the recursive parameter expansion (always on). They flipped the default on the former. They haven't done anything about the latter, AFAIK. I wonder if they will.
- est 5y ago> What is a legitimate reason for a logging library to make network requests based on the contents of what is being logged I encountered a similar problem recently, my own logger can get the current container/pod IP address, it's painful to tell which host from the IPs in logs, so I had to do a manual DNS lookup to include a hostname instead. I was hoping the logger could automatically do a lookup and cache it for me.
- suraci 5y agoWhy didn't write logs to stdout and scrape container log files by fluentbit/promtail/etc? I'm working on logging infrastructure now and really want to know the reason behind this(before I built it...)
- est 5y agoI do, but with a different log aggregator (vector.dev), there are three reasons: 1. the log aggregator doesn't exactly support DNS lookups 2. You have to parse the log first, exactly precisely where the IP part, then do a proper lookup. But sometimes the log is just a mess. 3. where the log aggregator located cannot do host lookup because of different network and different DNS server. So overall the lookup would better be done locally.
- Too 5y agoPretty sure the original rationale for this clusterfuck must have been something similar: “we only have user id here, but want the logs to contain user name”. Send this requirement to the cheapest bidder and here we are.
- anonymousiam 5y agoNSA TIA
- keyle 5y agoSo if you have a null pointer exception or something similar in production, you want to send that information to a remote host or alert system to be looked at urgently.
- markburns 5y agoI might be missing something, but wouldn't the point be that it's not the log writer's responsibility to do this, but rather some other service that consumes the unparsed output and sends the notification?
- keyle 5y agoAgreed. It's all nice to have. People want push. You can eat your pizza slice whichever way you want. Arguably this would be useful for critical events.
- makeitdouble 5y agoThis is the obvious solution now. I think 20 years ago it would have been slammed as overkill to have a separate process just to send logs. Even now actually, there is a flurry of libs/gems to send events/logs/analytics to a remote server (Datadog, NewRelic, Slack…)from the application itself. It’s usually not directly coupled with the logger, but it’s not far.
- abhishekjha 5y agoApps do send metrics from the process itself. Dropwizard metrics comes to mind. Wonder what timing RCE is waiting to happen there.
- Thorrez 5y agoPutting a feature in a logger to send logs remote is one thing. Putting a special syntax into the log message itself that gets parsed to decide where to send it is much weirder.
- 5y ago
- BinaryRage 5y agolog4j2 supports lookups, which allows you to add additional logging context: https://logging.apache.org/log4j/2.x/manual/lookups.html https://logging.apache.org/log4j/2.x/manual/lookups.html The problem here is the JNDI lookup because for historical reasons there is code in these providers which causes Java to deserialize and load bytecode if it's found in a result for a lookup against an LDAP server. That exploit was partially fixed in the JDK in 2008, then in 2018, but there are multiple naming providers that are affected. Yes, it's enabled by default before 2.15.0, released today to mitigate this issue.
- shp0ngle 5y agoI don’t understand these Java protocols enough to understand why was loading arbitrary bytecode from URLs even considered a feature, but I guess it was the 90s and Objects were all the rage
- AtNightWeCode 5y agoA lot of libs for logging have similar convenient ways for getting usernames and so on. The error here seems to be that even though you use the lib correctly a bug was introduced that made the injected parameters a part of the layout, at least that is what people are claiming. The example from the article though is an incorrect use of the lib and one can expect the same type of issues in a lot of libs when dealing with input parameters.
- shp0ngle 5y agoI understand that. I don’t understand JDNI, LDAP and why it ever downloads and runs remote bytecode and why was that ever considered a good feature.
- toyg 5y agoLDAP is typically a behind-the-firewall protocol. At that point, in the "old school" mindset, it's considered a trusted service. Having features to automatically pick up stuff across your own network of boxes might be considered useful by many an admin.
- ec109685 5y agoI believe the idea is that it lets you augment your log line with additional information to make it easier to read versus having to do the lookup at parse time.
- neop1x 5y agoI guess a full scripting language support in the log string should be the next big feature. Ideally with full FS and network access.